Memory-resident malware

F5 BIG-IP APM malware assembles its web shell inside Apache's memory

Sophos says the c05d5254 implant patches three BIG-IP APM PHP scripts only as Apache maps them, so the file comparison F5's March indicator list invited comes back clean while the httpd binary nobody diffed carries the code.