Author: DigitalSpying Security Desk
Date: September 13, 2026
Executive Summary
Network security appliances and identity gateways remain under persistent assault by nation-state and cybercrime actors seeking unmonitored ingress into enterprise infrastructure. In a technical revelation detailed by researchers at SophosLabs and ESET, and reported by Help Net Security and Security Affairs, threat actors are deploying an advanced, fileless Linux rootkit dubbed PoisonedRefresh on compromised F5 BIG-IP Access Policy Manager (APM) devices. Deployed as a stealthy post-exploitation implant following the abuse of critical remote code execution flaw CVE-2025-53521 (CVSS 9.3), PoisonedRefresh avoids disk-based detection entirely by injecting a functional PHP web shell directly into the memory space of running Apache HTTP worker processes. Operating without writing files to storage or opening external listening TCP ports, the rootkit provides adversaries with an invisible foothold on mission-critical edge gateways governing enterprise authentication.
Deep-Dive Technical Analysis
1. The Initial Foothold: Exploiting CVE-2025-53521
The infection chain begins with the exploitation of CVE-2025-53521:
* Vulnerability Profile: A critical unauthenticated remote code execution defect affecting F5 BIG-IP APM systems where an access policy is configured on a virtual server.
* Reclassification & Severity: Originally classified as a denial-of-service issue in late 2025, the vulnerability was re-evaluated and confirmed as a pre-auth RCE in early 2026, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.
* Initial Execution: Threat actors transmit malformed network packets targeting the virtual server's ingress port, bypassing authentication handlers to execute initial shellcode within the Linux operating system underlying BIG-IP TMOS.
2. Fileless In-Memory Web Shell Injection
Once initial shell execution is achieved, adversaries deploy the PoisonedRefresh rootkit, designed specifically to defeat disk-based forensic inspection:
* Targeting Apache HTTP Server Memory: F5 BIG-IP appliances rely on a modified Apache HTTP server daemon to handle web administrative interfaces, client SSL-VPN portals, and authentication sessions.
* Memory-Only Injection Mechanism: PoisonedRefresh attaches to active Apache parent and worker processes (httpd). Utilizing process injection techniques (similar to ptrace or shared library manipulation), it writes the PHP web shell bytecode directly into volatile process memory structures.
* Defeating File Integrity Monitoring (FIM): Because no script files (such as .php, .jsp, or .sh) are ever saved to the /var/, /usr/, or web root filesystems, standard disk scanners, MD5/SHA256 baseline checkers, and file integrity monitors report the filesystem as completely clean.
* Pre-Logging Request Interception: When an HTTP request containing the threat actor's specific activation headers arrives, the in-memory hook intercepts the payload, executes the arbitrary PHP commands, and generates a synthetic HTTP response before the request is processed by standard Apache logging modules. Consequently, access logs record no evidence of the malicious communication.
3. Covert Local Backdoor via UNIX Domain Sockets
To establish redundant persistence that evades perimeter network monitoring, PoisonedRefresh incorporates a secondary local backdoor:
* No New TCP Listeners: Traditional backdoors open a listening TCP port (e.g., binding to a high-numbered port like 4444 or 8080), which immediately triggers alerts on external network scans and perimeter firewalls.
* UNIX Domain Socket Binding: PoisonedRefresh creates and binds exclusively to an internal local UNIX domain socket within the Linux filesystem (/var/run/ or /tmp/).
* Interactive Shell Access: When an attacker connects to this local socket via internal pivoting or local process execution, the rootkit spawns an interactive root shell. Because the socket is entirely local to the kernel IPC layer, no external socket connections or firewall alerts are generated.
Architectural Layer
Traditional Malware Footprint
PoisonedRefresh Rootkit Tradecraft
Storage & Disk
Drops .php web shell in web root (/var/www/)
100% Fileless: Hooks directly into Apache worker process memory; zero disk writes.
Network Presence
Binds to a new TCP listening port
Zero TCP Ports: Listens on an internal local UNIX domain socket; communicates via in-memory HTTP hooks.
Telemetry & Logging
Generates HTTP access log entries for script URLs
Pre-Logging Execution: Intercepts requests before logging pipelines, suppressing forensic trace generation.
Access Gateway Risk
Standard server compromise
Enterprise Identity Compromise: Intercepts active Single Sign-On (SSO) credentials, MFA cookies, and VPN tunnels.
Industry Impact & Critical Edge Infrastructure Assessment
F5 BIG-IP APM devices are deployed in Fortune 500 enterprises, government agencies, healthcare networks, and defense contractors:
* The Identity Gateway Dilemma: APM serves as the zero-trust identity provider and SSL-VPN gateway connecting remote workers to internal corporate resources. Compromising the APM gateway allows adversaries to harvest plaintext credentials, capture active session cookies, and bypass enterprise Multi-Factor Authentication (MFA) without alerting downstream systems.
* Persistent Exposure: Threat telemetry from Shadowserver identified roughly 795 internet-exposed BIG-IP APM endpoints that remained unpatched against CVE-2025-53521 in September 2026, leaving them ripe for automated rootkit deployment.
* The "Patch-and-Forget" Fallacy: Applying vendor security patches seals the vulnerability against future exploitation, but does not evict an active in-memory rootkit or terminate hijacked processes. Organizations that patched without rebooting or performing memory forensics remain silently compromised.
Actionable Recommendations & Incident Response Protocols
1. Memory Forensics & Process Auditing
Because PoisonedRefresh leaves no disk artifacts, detection requires volatile memory analysis:
* Inspect Running Process Memory: Utilize live response tools to inspect memory mappings of running Apache processes (/proc/
* Audit UNIX Domain Sockets: Run ss -x -a or netstat -xl to inspect all bound UNIX domain sockets. Investigate any unmapped or unexpected sockets residing in temporary directories.
2. Complete Device Sanitization & Cold Reboot
* Volatile Memory Purge: Because PoisonedRefresh resides in process memory, performing a full system reboot (reboot or power-cycle) immediately terminates running in-memory web shells.
* Verify Configuration Integrity: Following reboot, run F5's built-in cryptographic verification utilities (tmsh load sys config verify and f5check) to ensure boot loaders and kernel modules were not modified.
* Upgrade to Patched Firmware: Ensure all BIG-IP APM branches are updated to verified maintenance releases: 15.1.10.8, 16.1.6.1, 17.1.3, or 17.5.1.3.
3. Credential Invalidation & Access Perimeter Hardening
* Rotate Edge Certificates & Passwords: In any suspected compromise, assume stored SSL private keys, LDAP service account passwords, and active session tokens have been harvested. Force-rotate all administrative passwords and re-issue gateway TLS certificates.
* Isolate Management Interfaces: Remove all BIG-IP TMOS administrative interfaces (https://
Sources and Reference Intelligence: Help Net Security, Security Affairs Technical Breakdown, CybelAngel Threat Analysis, CISA Known Exploited Vulnerabilities Catalog.