# Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

> **Open Intelligence Dossier** · First detected: 2026-09-09 07:07 UTC · Category: Technology

## Executive Summary
Hackers compromise F5 BIG-IP APM devices to deploy a fileless Linux rootkit and inject memory-only PHP web shells.

## Intelligence Brief
Recent reports outline a significant cybersecurity incident involving compromised F5 BIG-IP APM devices where malicious actors successfully deploy a Linux rootkit. Coverage details that the malware, identified in reports as PoisonedRefresh, functions as a fileless Linux rootkit that operates by hiding directly inside Apache memory while leaving the underlying F5 BIG-IP server files completely clean. By injecting PHP web shells into the server memory, the intrusion manages to bypass conventional disk scans. The reporting emphasizes the stealthy nature of the PoisonedRefresh malware and its specific interaction with F5 BIG-IP APM infrastructure.


Outlets such as BleepingComputer and The Hacker News highlight that the primary vector involves backdooring the servers with memory-only PHP web shells. Sophos and Security Affairs contribute technical dissections analyzing how the rootkit executes its injection strategies within the server memory space. Meanwhile, CyberSecurityNews and gbhackers.com focus on how the fileless architecture thwarts traditional forensic examinations that rely on checking disk integrity, because the malicious payloads leave no persistent footprints on the physical storage drives. Context provided across the coverage indicates that this threat targets enterprise-grade application delivery controllers, which often serve as critical network gateways.


Because F5 BIG-IP Access Policy Manager devices handle sensitive authentication and traffic routing, compromising them provides malicious actors with significant positioning within a network topology. The emphasis on memory-resident operations shows a deliberate evolution in attacker methodology, aiming to maintain persistence and avoid detection by security tools that monitor file systems rather than active random-access memory processes. Looking forward, the coverage does not yet specify particular remediation patches, affected entity counts, or the identities of the threat actors behind the PoisonedRefresh campaign. Readers must monitor upcoming advisories from vendor sources and cybersecurity researchers to determine mitigation steps, indicator of compromise lists, and firmware updates necessary to secure vulnerable F5 BIG-IP APM deployments against memory-based web shell injections.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Security Affairs | PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory | [Source Link](https://news.google.com/rss/articles/CBMi4wFBVV95cUxPTWNSNVdseDJLVFFLclJ3V1hHLVFfWHE0VUFCQXZoN0c0WDY3UEZfNTNwdG1nc0gtLTgzSlV4aXVxM0FuYndGV0VsSTlHVFBoelRvczJ6STJhMzFuM3VkTG5zMGwtZm1JaEdUeTdMZk5sTmt2MjRUTUFsYWNfMjFaLXJqRjNyenBTeUNvaEpIcWh0QUE0YkZUbHlQWGdUWUZMMEpyRWFuZ0UxeGpNbXRRbzRscTVPM285aG9ORkFXOHVXbm5KT1ZLRkF2RFRETXBreXFrcXd5RjFyNHBLeTBQNVVIUdIB6AFBVV95cUxNcF9LTUJwSmh3NnJMVld6UGpVQW43U3NjbzhSdE9iRE9uQVUxUkp0WENjajk2YjZoWVdYbHVVN2h6RndLY1oxUjFCckk4MzktQW9RN2NlMWRKcU5aYUh6R3F0SGp0bHZ0WlFKcjhsSnh) |
| The Hacker News | F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans | [Source Link](https://news.google.com/rss/articles/CBMiggFBVV95cUxOSXEwTUtNcTJTdDRpbzVEdDdPbGtFM1NJRW9NRUZkYXNRYll3ZGFZLVlyX3E1MnVfbWxYX205WkFqalR1ZlNzRGFLOFMtMndNZ0dueDdUSFdudGRLMjJaUmMwUmI2NmNiYTVLSmhFbWlfYjVLUHNCNkhEV1dLLVgzUV9B?oc=5) |
| BleepingComputer | Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxQNlRRZVJTZWNxNFZjdDNpV3lfNEFZUlJ2UmlQbG9EUlp0YlUtN2JuXzhrb3ZEMXlXMjBYV1FyT0Y5b1MxMTFrSlVyS3gyVHdLNTdVZkFkeUVvaTRicnlIc0tWbHlKNXBMQTRkS1pDbEdscUd5allOS2VrQkI1ODduTWRpYUgtc1ZmdmY4cHBqYWdYTDNWUWtDVjlYZmR1WHMzYnJlRVFuVDQtV3di?oc=5) |
| kobaran.com | PoisonedRefresh Malware Hides Inside Apache Memory While F5 BIG-IP Files Stay Clean | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxNeGt4YldwNnYwdTI0Nk1jUDU1dFVjaThCVmo2MTkxQkZ3RGlzYnowSzFVZmVjZDVjZzA2N1NBaG9yd3BYTUhzQ2J4cGl3OUx3bUZXdC1CTnFPYXFjTmZCUjNDN0djTERYNmwtVmItS0hDZ01wSlB2RWRNTmtTMl9iMUc3cDBCS004aFVKV1RqYURGdjZrZDFqVEJadGFnUV9nNFlTR3kydnVqZnhM?oc=5) |
| CyberSecurityNews | Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers | [Source Link](https://news.google.com/rss/articles/CBMiV0FVX3lxTE5yX3JyanZjZW9PRTZZTUxpRTE3VXl1blZpb1B5ZDNBN0htb0VyUkYzWWZmWUJYQkJFQXZ2THh3a0FUWHoxd0c1dHlMekk2YjdiVTVzV1V4a9IBXEFVX3lxTE5YZ254clhHeEI0dTNxOFYxY0hqZGl1djVJZ3pBdUZIMWZRbV9PelAyNzJkb1l1N3pJb3FBdlhNTkN0cHhWSHpvNlV3Q3lHRnlzSW9FSUlHU2ROWDB3?oc=5) |
| gbhackers.com | PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory-Only PHP Web Shells | [Source Link](https://news.google.com/rss/articles/CBMiWkFVX3lxTFBDQkZCdTk2WDBscUotMFBLLUZPWE1zcFRPV3RGand6di12SGNtSU1vU2NTQ1VyMWpWUENGMWwyYUpfanFqQzZjRERIcUJkeFZqN1BBUjdUcW53UdIBX0FVX3lxTE12dE5xNksycndaU19Cbml6LVBNeHVSSVZEVHZZTVJ6d2RZSU9QRThNU25NVXRxb21kQ20wTnBiWl9YMkZFUVhlUmZmYTAwNVY5QzZqZmI5QTd5ZzJ1R3VR?oc=5) |
| Sophos | Dissecting a PHP web server rootkit | [Source Link](https://news.google.com/rss/articles/CBMieEFVX3lxTE9JRzJQV0VaMFFxZ3c5a1RPSVF6Mm5IVlJqem5LM0J0MEpHdXc4a2FnLVRWcEZTQ21lQXJWTDNtN3E5Tm9WeHJFMWI1TFFmVUZlbzZoOG5UYS1ucjB0UjVWUVFKUVhxcWpJU1UxMEx5T3ZNTXlWZnVvbQ?oc=5) |
| BleepingComputer | Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxQNlRRZVJTZWNxNFZjdDNpV3lfNEFZUlJ2UmlQbG9EUlp0YlUtN2JuXzhrb3ZEMXlXMjBYV1FyT0Y5b1MxMTFrSlVyS3gyVHdLNTdVZkFkeUVvaTRicnlIc0tWbHlKNXBMQTRkS1pDbEdscUd5allOS2VrQkI1ODduTWRpYUgtc1ZmdmY4cHBqYWdYTDNWUWtDVjlYZmR1WHMzYnJlRVFuVDQtV3di0gGyAUFVX3lxTE9QRGQ0a2FfMFNCR0RVZ3lEU1BZSGVyenRHd2FYcWVhREhfREQtOFB5WWF0NExQMktYTE4zZi1UMUJaZVdPNmNqeDJMdHJLb243U0xZYzJSQWhxYWY3a1h3Qk9DYlRwdHYzTjlqeF9DYktfekI0RUc4Q2xzSmtUdXlFWXV6aTlpREJXNXNMWUJtRTduSXZacjlPS0FDdF9KMGF6aWdCOTl) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-09-09/hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit*