security1 publisher
Rootkit on F5 BIG-IP APM appliances keeps its web shell in Apache's memory
Sophos says the implant hooks Apache's module loader and rewrites BIG-IP APM webtop scripts in memory, leaving the files on disk untouched, while the installer that put it there is built to survive an upgrade image.
Publishers:helpnetsecurity.com
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives55
- Confidence58