Fileless Linux Rootkit Targets F5 BIG-IP APM via Critical RCE
Sophisticated malware bypasses disk-based detection by injecting PHP web shells directly into server memory.
Security researchers, including Sophos, have identified a sophisticated Linux rootkit targeting F5 BIG-IP Access Policy Manager (APM) environments. The malware leverages a critical pre-authentication remote code execution (RCE) vulnerability to gain initial access and deploy a stealthy implant designed for long-term persistence.
The attack is linked to the exploitation of CVE-2025-53521, a critical unauthenticated RCE vulnerability with a CVSS score of 9.8. Once attackers breach the system, they deploy a rootkit specifically targeting BIG-IP APM webtop environments that utilize Apache and PHP components. According to SophosLabs, the implant intercepts the loading of specific PHP files—including full_wt.php3, apm_css.php3, and webtop_popup_css.php3—and prepends a web shell to their in-memory representation during mmap() time.
The Shift to Fileless Persistence
F5 BIG-IP APM serves as a cornerstone for many organizations, providing secure remote access and application delivery. Traditionally, attackers deploying web shells would write malicious scripts into web-accessible directories on the disk. However, this rootkit employs a "fileless" approach, targeting the runtime memory of the Apache/PHP process instead of the file system.
By manipulating how the server loads PHP files into memory, the malware ensures that the malicious code never touches the disk. This technique allows attackers to maintain a functional command-and-control interface while remaining invisible to standard security audits that rely on scanning the file system for unauthorized changes.
Implications for Network Security
This campaign represents a high level of technical sophistication, combining a high-severity vulnerability with advanced Linux kernel-level tradecraft. Because the web shell exists only in memory, traditional endpoint detection and response (EDR) systems, antivirus scans, and file integrity monitoring tools are largely ineffective.
For the industry, this highlights a critical blind spot in gateway security. When a network's primary entry point is compromised by a fileless implant, advanced persistent threat (APT) actors can maintain invisible access to the perimeter. This positioning is particularly dangerous, as it provides a stable platform from which attackers can pivot deeper into internal corporate networks to exfiltrate data or deploy further payloads.
Monitoring and Mitigation
Organizations using F5 BIG-IP APM are urged to prioritize patching CVE-2025-53521 to close the initial entry vector. Because the rootkit is designed to evade disk-based detection, security teams may need to rely on memory forensics and behavioral analysis of Apache and PHP processes to identify existing compromises.
While the mechanism of the rootkit has been dissected, the full scope of the campaign and the specific actors behind the deployment remain under investigation. Defenders should monitor for unusual memory allocations and unexpected outbound traffic originating from their APM gateways.