Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Recent reports outline a significant cybersecurity incident involving compromised F5 BIG-IP APM devices where malicious actors successfully deploy a Linux rootkit. Coverage details that the malware, identified in reports as PoisonedRefresh, functions as a fileless Linux rootkit that operates by hiding directly inside Apache memory while leaving the underlying F5 BIG-IP server files completely clean. By injecting PHP web shells into the server memory, the intrusion manages to bypass conventional disk scans. The reporting emphasizes the stealthy nature of the PoisonedRefresh malware and its specific interaction with F5 BIG-IP APM infrastructure.

Outlets such as BleepingComputer and The Hacker News highlight that the primary vector involves backdooring the servers with memory-only PHP web shells. Sophos and Security Affairs contribute technical dissections analyzing how the rootkit executes its injection strategies within the server memory space. Meanwhile, CyberSecurityNews and gbhackers.com focus on how the fileless architecture thwarts traditional forensic examinations that rely on checking disk integrity, because the malicious payloads leave no persistent footprints on the physical storage drives. Context provided across the coverage indicates that this threat targets enterprise-grade application delivery controllers, which often serve as critical network gateways.

Because F5 BIG-IP Access Policy Manager devices handle sensitive authentication and traffic routing, compromising them provides malicious actors with significant positioning within a network topology. The emphasis on memory-resident operations shows a deliberate evolution in attacker methodology, aiming to maintain persistence and avoid detection by security tools that monitor file systems rather than active random-access memory processes. Looking forward, the coverage does not yet specify particular remediation patches, affected entity counts, or the identities of the threat actors behind the PoisonedRefresh campaign. Readers must monitor upcoming advisories from vendor sources and cybersecurity researchers to determine mitigation steps, indicator of compromise lists, and firmware updates necessary to secure vulnerable F5 BIG-IP APM deployments against memory-based web shell injections.