Fileless Linux rootkit hides web shells in memory on hacked F5 BIG-IP systems

Security researchers have documented a Linux rootkit that hides an entire web shell inside a running server's memory, leaving no trace on disk for antivirus tools or file-integrity scanners to find. The implant, tracked by Sophos as Linux/Agnt-IC and named "PoisonedRefresh" by ESET, has been found on compromised F5 BIG-IP Access Policy Manager (APM) systems, the access-control component many large organizations use to broker remote logins and VPN-style connections into their networks.

SophosLabs published a detailed technical dissection of the malware on September 8, describing an implant that intercepts how the Apache web server and PHP load files, then rewrites the in-memory copy of legitimate BIG-IP scripts to smuggle in attacker commands while the corresponding files on disk remain untouched. ESET researchers, who separately recovered and analyzed samples of the same family in April, reached similar conclusions about its design and flagged it as unusually sophisticated tradecraft for a web shell.

How the implant works

According to Sophos's analysis, PoisonedRefresh operates in two stages. A first-stage component, disguised inside the system's umount utility, infects the Apache binary, disables SELinux protections, and re-infects the installation media used for BIG-IP software upgrades, so the backdoor can survive a patch or reinstall and spread to other appliances. The second stage is the fileless part: it hijacks the C library's startup routine to gain control before Apache's own code runs, then hooks the Apache Portable Runtime's module-loading function to wait for PHP to initialize. Once PHP is running, it intercepts calls that map three legitimate BIG-IP webtop files into memory, and silently prepends a web shell to what the server actually executes.

"The web shell does not need to exist in its final form on disk. Instead, the implant alters how targeted PHP files are presented to the running process, meaning the content observed by Apache and PHP can differ from the content visible to traditional file-based inspection," Sophos researchers wrote.

The web shell itself only responds to requests carrying a specific prefix, and it answers with an HTTP 201 status code and a text/css content type to blend in with ordinary web traffic. A second, independent backdoor channel runs through a Unix domain socket, which hands an attacker an interactive bash shell after a password check, without opening any listening network port that a port scan would reveal.

The vulnerability behind it

Both research teams tie the rootkit's deployment to CVE-2025-53521, an unauthenticated remote-code-execution flaw in BIG-IP APM that F5 disclosed in October 2025 as a lower-severity denial-of-service issue before quietly upgrading its own advisory in March 2026 to reflect a critical severity score once evidence of active exploitation emerged. The bug affects APM instances across multiple release branches when an access policy is bound to a virtual server.

The reclassification triggered wider alarm. CISA added the flaw to its Known Exploited Vulnerabilities catalog in late March, giving federal civilian agencies days to patch, and the Dutch National Cyber Security Center separately confirmed observing abuse of the same flaw. Internet-wide scanning, reported by Bleeping Computer, found roughly 800 BIG-IP APM endpoints still openly exposed to the vulnerability as of early September, down substantially from the tens of thousands flagged in the weeks after F5's original October disclosure, but still a meaningful population of unpatched, internet-facing devices eight months on.

The episode lands against the backdrop of a separate, larger F5 security crisis. In an SEC filing disclosed in October 2025, F5 said nation-state hackers had sat undetected inside its network for roughly a year and made off with portions of BIG-IP's source code and details of vulnerabilities the company had not yet patched. That breach prompted CISA to issue an emergency directive ordering federal agencies to inventory and lock down BIG-IP management interfaces. Researchers have not confirmed that the stolen material was used to build PoisonedRefresh, but the timing has sharpened scrutiny of every subsequent BIG-IP flaw.

Who is exposed, and how defenders can respond

BIG-IP APM sits at the front door of many large enterprise, government and telecom networks, brokering VPN access, single sign-on and endpoint checks before a remote user reaches internal systems, which is precisely why a foothold there is valuable to an intruder. The UK's National Cyber Security Centre told organizations running the product that all deployments of BIG-IP APM should be considered affected by the underlying flaw, regardless of sector. A device compromised by this rootkit gives an attacker a persistent, largely invisible route back into that access layer even after a security team has reimaged or patched the underlying host, unless the reinfected upgrade media is also identified and purged.

Because the malicious code never touches disk in its final form, conventional file-integrity monitoring and signature-based antivirus scans will not surface it. Sophos's write-up instead recommends behavioral detection: watching for Apache worker processes that read their own memory maps and subsequently alter memory-page permissions, unexpected requests to the targeted PHP files, and unusual HTTP 201 responses on endpoints that should return normal webtop content. F5 has published its own indicators of compromise and a companion advisory on the malware, urging customers to compare disk contents against known-good file hashes.

What comes next

Neither Sophos nor ESET has attributed the campaign to a named threat actor, though both describe the malware's engineering as indicative of a well-resourced operator running a targeted, rather than opportunistic, campaign. F5 has not linked PoisonedRefresh to last October's source-code theft, and researchers describe the two incidents as separate, though the earlier breach has left customers warier of every BIG-IP advisory that follows it.

For now, the practical guidance from all parties converges on the same point: applying F5's patches for CVE-2025-53521 closes the initial entry point, but any BIG-IP APM system that was internet-facing and unpatched during the intervening months should be treated as potentially compromised and inspected for the rootkit's memory-resident and installer-level indicators rather than assumed safe once the underlying flaw is fixed.