Rootkit on F5 BIG-IP APM appliances keeps its web shell in Apache's memory

The hooks land before Apache's own main() function runs. Sophos said the second-stage sample "hides key operational strings with RC4, gains execution before the host application main() function is invoked by intercepting __libc_start_main", then "targets Apache's PHP module by hooking the Apache Portable Runtime (APR) module loader (apr_dso_load), and injects a PHP web shell into memory" ^[6]. From there it intercepts PHP file operations and rewrites them in memory to plant a web shell inside apm_css.php3, full_wt.php3 and webtop_popup_css.php3 ^[7]. Sophos says those three were likely chosen because they are common in BIG-IP APM webtop environments and unlikely to draw attention ^[10].

"When PHP opens one of these files, the implant records the file descriptor. When that file is subsequently memory mapped, the implant creates a modified in-memory view containing both the embedded web shell and the original script content. The on-disk file does not need to contain the final web shell content at all," Sophos said ^[8]. So pull those scripts off a compromised appliance and compare them byte for byte against a known-good build, and they match, because the implant never edits them ^[2].

Sophos said the malware "targets deployments featuring Apache, libphp, APR module loading, BIG-IP APM webtop components, and BIG-IP upgrade workflows, suggesting it was developed for specific environments" ^[12]. The installer found in the related sample called umount is the piece that infects /usr/sbin/httpd and carries the infection across upgrade images ^[5]. F5 has tied related activity to CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM already exploited in the wild ^[3]. The published account does not say whether the implant arrived through that flaw in every case, or how many appliances were compromised ^[20].

The detection advice is all runtime. Sophos lists requests to the three .php3 files, PHP endpoints that return an HTTP 201 status while claiming to serve CSS content, and Apache worker processes that read /proc/self/maps and then change memory permissions shortly after ^[15]. It suggests blocking .php3 execution where it is not needed, with the caveat that BIG-IP APM administrators should follow F5's guidance before making that change ^[16]. It also suggests restricting ptrace access, and notes this would not necessarily stop the implant's in-process behavior ^[17].

The second access route is unresolved. Sophos found no code in the sample that would let an attacker reach /run/bigtlog.pipe from outside the server, so it is not clear how the socket and the web shell are meant to work together, or whether one is used to reach the other ^[14]. "Based on our analysis of the related umount and infected httpd samples, we assess that this campaign involves a staged architecture," Sophos said ^[18].