AI Generated Image
Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
BleepingComputer • • technology
Key Points:
- A Linux rootkit targeting F5 BIG-IP APM devices can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding disk-based detection.
- The malware is believed to be a second-stage payload deployed after exploiting the critical CVE-2025-53521 remote code execution vulnerability in F5 BIG-IP APM systems.
- The rootkit modifies Apache’s PHP module loader to hide the web shell in memory within legitimate PHP scripts, which remain unchanged on disk to reduce detection risk.
- It creates a password-protected local UNIX socket backdoor for interactive Bash shell access without exposing a TCP port, requiring attackers to have an existing foothold on the device.
- Sophos advises monitoring for suspicious Apache activity such as unusual POST requests to specific .php3 files, HTTP 201 responses with CSS content, and indicators like /proc/self/maps reads or creation of /run/bigtlog.pipe.
