Security1 publisher3 min readPublished
F5 BIG-IP APM malware assembles its web shell inside Apache's memory
Sophos says the c05d5254 implant patches three BIG-IP APM PHP scripts only as Apache maps them, so the file comparison F5's March indicator list invited comes back clean while the httpd binary nobody diffed carries the code.
The Watch · Security desk
What happened
- Sophos says the malware behind break-ins at F5 BIG-IP APM appliances adds a PHP web shell to the in-memory copy of three appliance scripts as Apache loads them, leaving the files on disk unchanged.
- The three scripts, apm_css.php3, full_wt.php3 and webtop_popup_css.php3, are the same ones F5 listed in March as indicators for the malware it tracks as c05d5254 while saying their presence alone proves nothing.
- CISA added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog on March 27, 2026, the day F5 reclassified the bug from denial of service to remote code execution and said it had been exploited.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint An appliance cleared by comparing those three php3 files against known-good copies has been verified against the one artifact this implant is built not to alter, so that result carries no weight and the check has to move to the httpd binary.
- capability The token-gated /run/bigtlog.pipe socket hands an operator a bash session without a listening port, which puts the second access path outside the reach of port and netflow hunting.
- exposure Because ESET found the implant written into BIG-IP install images, the media an operator would reach for to rebuild a suspect appliance is itself in scope.
- contradiction F5 told customers both that web shells were written to disk and that they work in memory only; a defender who built a detection plan from the first half of that got a file-comparison check the malware satisfies.
The code prepended to /usr/sbin/httpd runs before Apache's own code starts, hooks the Apache Portable Runtime function apr_dso_load, and stays inert until Apache loads the PHP module libphp [8]. Then it reads /proc/self/maps to find the module in memory, makes those pages writable long enough to rewrite the calls PHP uses to open, size and map files, and puts the original permissions back [9]. From there it controls what PHP sees when it opens apm_css.php3, full_wt.php3 or webtop_popup_css.php3, and when the file is mapped the web shell goes in front of the original content [9][3]. Sophos put the consequence for defenders in one line: the web shell "does not need to exist in its final form on disk" [6].
Traffic to it reads as a stylesheet fetch. The shell takes the raw body of a request, checks it for a short marker, decrypts the rest, runs it, and answers with HTTP status 201 and a CSS content type [10]. A second path avoids the network: a local socket at /run/bigtlog.pipe that, after a fixed token check, is connected to /bin/bash, giving an interactive shell with no port opened [11]. Sophos found no code in the sample that connects to that socket and no other use of the token, and reads the two as separate features [12].
F5 first published CVE-2025-53521 on October 15, 2025, and it stood as a denial-of-service problem for 163 days [15][1]. The March 27 reclassification made it unauthenticated remote code execution, already exploited, at 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0 [16]. CISA's catalog entry carried a March 30 due date, three days [17][3]. By the date of the Sophos analysis the fixed release had been available for 327 days [2], and Ireland's National Cyber Security Center said on March 31 that the October patch still protects against exploitation [19]. The flaw applies where a BIG-IP APM access policy is set on a virtual server, and the UK's National Cyber Security Center calls BIG-IP APM a common component, especially in large organizations [18].
Sophos examined one sample, named no victim, and did not say how the sample was obtained [13]. ESET's April analysis of related samples, which it calls PoisonedRefresh, adds that the installer expects to run as root, turns off SELinux, and infects umount, httpd and rc.local inside BIG-IP install images, which ESET read as a way to reach other systems through installation media [20]. So the clean-media assumption behind a rebuild needs its own check. The disk artifact worth pulling is the Apache binary: Sophos matched the size of the code added to the front of /usr/sbin/httpd against the payload carried inside the installer, which it said strongly suggests the installer put it there [7].
What to watch
- Whether F5 revises its March indicator list to point defenders at /usr/sbin/httpd rather than the three php3 files.
- Whether a second sample turns up carrying a client for the /run/bigtlog.pipe socket, which would show that access path in use rather than merely present.
- Whether any victim count or intrusion set emerges; Sophos worked from one sample and named nobody.