F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7.

When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean. Those three scripts are the same ones F5 pointed customers to in March, when it said changes to them alone do not show a break-in.

A web shell is usually a small script an attacker drops into a web server's folders to run commands through ordinary web requests. Because it sits on disk, defenders look for it by scanning files and comparing them against known-good copies.

That approach does not work here. As the researchers put it, the web shell "does not need to exist in its final form on disk."

The three scripts are apm_css.php3, full_wt.php3 and webtop_popup_css.php3, part of the BIG-IP APM webtop. F5 named all three in March in a published list ofindicators of compromisefor the malware it tracks as c05d5254, and said at the time that their presence alone does not point to a security problem.

F5 also said it had seen cases where a web shell was written to disk, but that the web shells "have been observed to work in memory only," which means the files it listed might not be modified. The Sophosanalysisexplains how both statements can be true at once.

Sophos examined a single sample. Its analysis names no victim and does not say how the sample was obtained.

F5 has linked the c05d5254 activity to appliances affected byCVE-2025-53521, Sophos said. F5 first publishedthat flawon October 15, 2025, as a denial-of-service problem.

On March 27, 2026, F5 said new information had led it toreclassify the flaw as remote code execution, and that it had been exploited. An attacker needs no login to use it, and F5 rates it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0.

CISA added it to its Known Exploited Vulnerabilities catalog the same day, giving U.S. federal civilian agencies until March 30 to act.

The flaw applies where a BIG-IP APM access policy is set on a virtual server. The UK's National Cyber Security Center calls BIG-IP APM a common component, especially in large organizations. F5'sadvisorylists the affected and fixed releases.

The patch that fixes this is nearly a year old. Ireland's National Cyber Security Center said in aMarch 31 advisorythat the patch released in October is still valid and will protect against exploitation.

The web shell is the last step in a longer chain, and the earlier steps do touch the disk. Sophos said a separate installer, found in a sample named umount, infects the Apache web server program at /usr/sbin/httpd by adding malicious code to the front of the real file. The size of that added code matches the payload carried inside the installer, which Sophos said strongly suggests the installer puts it there.

ESET, whichanalyzed related samples in Apriland named the malware PoisonedRefresh, said the installer is meant to be run as root and turns off SELinux. It also infects umount, httpd and rc.local inside BIG-IP install images, which ESET said was presumably done to spread the malware to other systems through the installation media.

Because the malware sits inside the Apache program, it runs before Apache's own code starts. Sophos said it hooks an Apache Portable Runtime function, apr_dso_load, and does nothing until Apache loads the PHP module, libphp.

Once PHP is loaded, the malware reads /proc/self/maps to find the module in memory, briefly makes those memory pages writable, rewrites the calls the module uses to open, size, and map files, then puts the original permissions back. From that point, it controls what PHP sees when it opens one of the three scripts. When the file is mapped into memory, the malware places the web shell in front of the original content.

The web shell reads the raw body of a request, checks it for a short marker, decrypts the rest, and runs it. It replies with HTTP status 201 and a CSS content type, so the exchange looks like a request for a stylesheet.

The malware also opens a local socket at /run/bigtlog.pipe. After checking for a fixed token, it connects that socket to /bin/bash, giving an interactive shell without opening a network port.

Sophos said it could not find any code in the sample for connecting to that socket, and no other use of the token, so the two ways in look like separate features. It has no evidence either way on whether the attacker reaches the socket through the web shell.

Sophos said its behavioral signals are leads to investigate, not proof on their own, and should be read alongside file, process, and memory evidence. The list below combines them with the indicators F5 published in March.

F5's list also includes items the Sophos analysis does not cover, among them /run/bigstart.ltm and the changes affecting sys-eicheck. Neither account describes the whole intrusion.

Patching does not settle whether an appliance was compromised before the patch went on.

Ireland's NCSC said no timeline for exploitation is available, and that it expects some exploitation was or could have been happening before the flaw and its fix were first published in October 2025.

The UK's NCSC advises investigating for compromise "regardless of when the system was updated."

Three things are still unknown. F5 has not said when exploitation began.

None of the published advisories or analyses say whether upgrading an appliance to a fixed release removes malware already installed on it, and both Sophos and ESET describe a component designed to survive upgrade images.

And no one has named an attacker: Sophos said it does not have enough evidence to name a group, and ESET said in April that it had not settled the question either.