PoisonedRefresh embeds memory-only shells in F5 BIG-IP

Security researchers have detailed a stealthy Linux implant, dubbed PoisonedRefresh, that backdoors compromised F5 BIG-IP Access Policy Manager systems by injecting PHP web shells directly into server memory while leaving legitimate files on disk unchanged.

The malware has been associated with exploitation of CVE-2025-53521, a critical unauthenticated remote code execution vulnerability in BIG-IP APM when an access policy is configured on a virtual server. F5 has confirmed exploitation of the flaw and has linked the related compromise activity to a cluster it tracks as c05d5254.

SophosLabs, which analysed a recovered implant, said the malware manipulates Apache and PHP processes so selected BIG-IP APM webtop scripts are altered only when mapped into memory. The technique can allow malicious code to execute even though filesystem checks show the original PHP files as intact, weakening a common method used by defenders to identify web shells.

Researchers observed the implant targeting three legitimate scripts: apmcss. php3, fullwt. php3 and webtoppopupcss. php3. When PHP opens one of those files, the malware records its file descriptor and intercepts the subsequent memory-mapping operation, creating an altered in-memory copy that contains an embedded web shell alongside the original script.

The injected PHP code reads raw request data, checks for a predefined marker, decrypts the remaining content and passes it to PHP for execution. Researchers said responses can use HTTP status 201 and identify themselves as CSS content, a combination designed to make command traffic less conspicuous among requests associated with the APM web interface.

PoisonedRefresh also provides a separate access mechanism through a local UNIX domain socket at /run/bigtlog. pipe. After authentication, the implant can redirect standard input, output and error streams to /bin/bash, providing an interactive shell without opening a conventional TCP listening port that could be detected through routine network scans.

The implant gains control early in the Apache process lifecycle. Sophos said it uses a custom ELF loader and intercepts the libcstartmain routine, allowing malicious code to run before the host application reaches its normal main function. It then hooks Apache Portable Runtime loading functions, particularly aprdsoload, and waits for the server to load libphp.

Once libphp is present, the malware locates the module through /proc/self/maps, temporarily changes memory protections and modifies function calls involved in opening, closing, sizing and mapping PHP files. Operational strings are encrypted with RC4 and decrypted at runtime, further reducing obvious indicators in the binary.

Analysis of a related component indicates the intrusion can also infect /usr/sbin/httpd, modify SELinux settings and target BIG-IP upgrade workflows to help preserve the compromise across software installation or upgrade operations. Sophos described the analysed implant as a second-stage payload and said a separate component appears responsible for deploying it.

ESET researchers separately analysed the malware and applied the PoisonedRefresh name. Public analysis has not established sufficient evidence to attribute the implant to a specific threat actor, and the observed targeting is focused on BIG-IP APM webtop environments rather than generic Apache or PHP installations.

CVE-2025-53521 was originally disclosed by F5 in October 2025 and was later reclassified as an unauthenticated remote code execution flaw after additional information emerged. It carries a CVSS 4.0 base score of 9.3 and was added by the US Cybersecurity and Infrastructure Security Agency to its Known Exploited Vulnerabilities catalogue on March 27, 2026.

Affected BIG-IP APM branches include versions 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, 17.1.0 through 17.1.2 and 17.5.0 through 17.5.1. Fixed releases include 15.1.10.8, 16.1.6.1, 17.1.3 and 17.5.1.3.

F5 has advised organisations running vulnerable versions, or systems upgraded from them, to review its compromise indicators and conduct an assessment rather than relying on patching alone. The UK’s National Cyber Security Centre has similarly urged organisations to investigate affected products for signs of compromise regardless of when updates were applied.