The chain runs backwards from the file Sophos analyzed, which it assesses to be a second stage [3]. Stage one turned up during parallel analysis of a related `umount` sample: an installer and propagation component that infects /usr/sbin/httpd, modifies SELinux configuration, persists across BIG-IP upgrade images, and drops the payload [3]. The first-stage loader hunts for BIG-IP upgrade and install-image workflows under paths such as /mnt/tm_install [4]. What ties the two together is a size match. The malicious prefix on the infected httpd is 0x5430, the same as the payload embedded in the `umount` sample [5]. In decimal that is 21,552 bytes [1], and Sophos calls the match strong evidence that the `umount` component deploys the httpd infection [5].
The runtime tradecraft is where disk-based detection stops working. Operational strings are hidden with RC4. Execution is obtained before the host application's `main()` by intercepting `__libc_start_main`. The APR module loader `apr_dso_load` is hooked to reach Apache's PHP module, and `mmap` behaviour inside libphp is manipulated so a PHP web shell is prepended to the in-memory representation of selected files, visible only to the infected process and never written to disk [6]. Because the redirected calls sit in libc and libphp inside Apache worker processes, every PHP component running in that worker is affected, not one planted script [13]. Sophos notes that detection logic has relied on scanning the web root, checking parameter names against known signatures, and trusting file integrity monitoring -- approaches built on the opposite of how this implant behaves [12].
There is a second door. The implant opens a local UNIX domain socket and can redirect a connection into /bin/bash, so interactive access does not require a TCP listener [7].
Scope is narrower than "Apache and PHP". Sophos says the observed targeting centres on BIG-IP APM webtop environments, not generic Apache or PHP stacks or common CMS deployments [9]. F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated RCE that requires an access policy configured on a virtual server [2]. Outside that configuration, and outside BIG-IP, the findings in this teardown do not apply.
The material published so far does not include a victim count, a first-exploitation date, or a named operator. The only other public analysis referenced is ESET's, which named the malware PoisonedRefresh; Sophos says it observed overlapping behaviour independently [10]. The one hash published is the second-stage sample [11], which is the component least likely to be sitting on disk.
The remediation path for an appliance bug is normally an upgrade, and here the upgrade image is one of the things the installer persists through [3]. Sophos's own instruction is to follow F5's remediation and compromise-assessment guidance before applying generic Apache or PHP hardening [8]. A patched version string on an APM box that had an access policy on a virtual server only confirms the software was updated. It does not confirm who else still has a shell on it.
