Fileless Rootkit 'PoisonedRefresh' Targets F5 BIG-IP APM Appliances

Security researchers have uncovered a sophisticated Linux rootkit targeting F5 BIG-IP Access Policy Manager (APM) appliances, utilizing advanced memory-injection techniques to maintain a stealthy foothold. Identified as 'PoisonedRefresh' by ESET and 'Linux/Agnt-IC' by Sophos, the malware allows attackers to execute server-side code while leaving the underlying system files untouched.

The malware is deployed as a second-stage payload following the exploitation of CVE-2025-53521, a critical remote code execution (RCE) flaw in the BIG-IP APM. Once active, the rootkit targets three specific webtop scripts—apm_css.php3, full_wt.php3, and webtop_popup_css.php3—for in-memory injection. To evade detection, the rootkit intercepts PHP file operations, including open, close, mmap, and __fxstat, modifying the scripts only when they are mapped into memory. As GBHackers noted, citing Sophos, "the original files remain benign on disk, while the Apache worker process executes an altered version in memory."

Stealthy Command and Control

The implant operates a hidden web shell that listens for specific "magic" requests. Upon receiving these, the malware decrypts the payload, executes it via PHP's eval() function, and returns an HTTP 201 response disguised as legitimate CSS content. Beyond the web shell, the rootkit establishes a password-protected local UNIX domain socket located at /run/bigtlog.pipe, which provides attackers with an interactive Bash shell for deeper system control.

To achieve this level of persistence, the malware employs a custom ELF loader and hooks the Apache Portable Runtime (APR) module loader (apr_dso_load). This allows the rootkit to seize control before the host application's main() function is even invoked. According to Sophos, this specific timing minimizes the risk of destabilizing the service and helps the implant blend into normal runtime behavior.

Industry Implications

This campaign represents a significant shift toward "fileless" persistence in network appliances. Because F5 BIG-IP APM sits at the network perimeter and handles sensitive remote access credentials, a compromise here provides attackers with a trusted position inside a corporate network. By blending malicious traffic into standard CSS requests and avoiding disk modifications, the attackers render traditional file-hash monitoring and disk-based integrity checks ineffective.

What to Watch

The scale of the campaign is already evident; the ShadowServer Foundation reported that 795 endpoints were exposed online as of September 6, 2026. Organizations using F5 BIG-IP APM should prioritize patching CVE-2025-53521 and monitor for unusual UNIX domain sockets or anomalous HTTP 201 responses. Security teams must now shift focus toward memory forensics and runtime behavioral analysis, as traditional signature-based scanning is insufficient against this class of rootkit.