DEV Community

Anoymask
Anoymask

Posted on

PoisonedRefresh: A Linux Rootkit Injecting an In-Memory Web Shell into BIG-IP APM

#security #threatintel

1. Basic Information

2. Executive Summary

PoisonedRefresh is a Linux rootkit that uses a modified BIG-IP APM Apache executable to alter libphp at runtime and inject a web shell only into the in-memory contents of legitimate PHP files.

3. Attack Flow

PoisonedRefresh: In-memory web shell injection into BIG-IP APM

  1. An attacker gains initial access to BIG-IP APM. Sophos links the activity to CVE-2025-53521, but the entry path for the individual sample remains unconfirmed.
  2. The installer modifies httpd, SELinux, and update handling so that the second stage continues to load after restarts and updates.
  3. The second stage installs a custom loader and function hooks around Apache startup and waits for libphp to load.
  4. It adds a web shell only to the memory mappings of targeted PHP files, then decrypts and executes POST requests containing an identifying marker.
  5. Connecting to a UNIX socket from a separate local foothold provides an interactive Bash shell without a TCP listener.

4. Attacker Position and Execution Environment

  • An external attacker able to reach BIG-IP APM, and malware holding elevated privileges on the appliance after deployment.
  • Using the UNIX socket path requires another local foothold on the appliance.

5. What Users and Administrators May See

Users

  • Because the activity blends into normal web responses, CSS responses and the service may appear normal to users.

Administrators

  • Inference: Even when PHP files on disk are intact, the running Apache process may contain malicious hooks or a web shell.

6. Success Conditions and Risk Reduction

Success Conditions

  • The attacker can deploy the implant to a vulnerable or already compromised BIG-IP APM appliance.
  • The modified httpd starts with Apache/libphp and the targeted PHP files are loaded.
  • Requests containing the identifying marker or local socket communications are not detected and blocked.

Failure Conditions and Risk Reduction

  • Apply F5’s fix for CVE-2025-53521 and investigate for compromise; a version upgrade alone does not complete the response.
  • Compare httpd, upgrade images, SELinux configuration, and Apache worker memory with known-good baselines.
  • Isolate and preserve suspected compromised appliances, rebuild them from trusted images, and rotate credentials on the appliance and in connected systems.

7. Potential Impact

  • A fileless web shell and arbitrary PHP execution on BIG-IP APM.
  • An interactive shell without opening a TCP listener.
  • Theft of authentication information, sessions, and configuration; traffic manipulation; and a foothold into internal networks.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

  • Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records.
  • Proxy/SWG/DNS: Where TLS traffic is visible to a reverse proxy or WAF, investigate POSTs to the targeted .php3 files and HTTP 201 responses with a text/css content type. DNS logs alone do not reveal bodies or response codes.
  • Endpoint/EDR: Use available appliance process/file auditing and preserved memory to investigate httpd modification, malicious libphp hooks, UNIX sockets, and Bash execution. Observing operations such as mprotect requires additional instrumentation.
  • Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval.
  • SaaS/Cloud: For cloud deployments, review audit records for workloads, IAM, and API operations.
  • Network: Review appliance destinations and traffic volumes. UNIX socket communications do not appear in TCP flows.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations.

  • Attempt observed (success unconfirmed): Evidence criterion: Confirm requests containing the identifying marker to the targeted .php3 files, or related probing.
  • User interaction confirmed: Evidence criterion: User interaction is not required.
  • Initial execution confirmed: Evidence criterion: Confirm startup of the modified httpd, or malicious hooks and memory modifications in a running Apache process. Modification on disk alone does not establish execution.
  • Malware execution or authentication success confirmed: Evidence criterion: Confirm web shell eval() execution or /bin/bash execution through the UNIX socket.
  • Data theft or session compromise confirmed: Evidence criterion: Confirm unauthorized access to or exfiltration of credentials, sessions, or configuration.
  • Follow-on compromise confirmed: Evidence criterion: Confirm additional payloads, configuration changes, or internal connections.

10. Investigation Playbook

Inference: Operational recommendations based on publicly described behavior.

  • Trigger: Suspicious POSTs to targeted .php3 files, httpd modification, or malicious Apache hooks.
  • Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure.
  • Endpoint: Use available appliance process/file auditing and preserved memory to investigate httpd modification, malicious libphp hooks, UNIX sockets, and Bash execution. Observing operations such as mprotect requires additional instrumentation.
  • Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations.
  • Follow-on Activity: Review appliance destinations and traffic volumes. UNIX socket communications do not appear in TCP flows.
  • Containment: Isolate suspected compromised appliances, preserve memory and configuration, and follow F5’s recovery and credential-rotation procedures.
  • Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations.

11. Defense and Detection Ideas

Inference: Operational recommendations based on publicly described behavior.

  • Single Event: Suspicious POSTs to targeted .php3 files, httpd modification, or malicious Apache hooks.
  • Time-Series Correlation: On the same appliance, correlate httpd modification and startup, memory changes after libphp loads, and POSTs to the targeted PHP files.
  • Threat Hunting: Where TLS traffic is visible to a reverse proxy or WAF, investigate POSTs to the targeted .php3 files and HTTP 201 responses with a text/css content type. DNS logs alone do not reveal bodies or response codes. Review appliance destinations and traffic volumes. UNIX socket communications do not appear in TCP flows.
  • Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise.
  • Priority Controls: Apply F5’s fix for CVE-2025-53521 and investigate for compromise; a version upgrade alone does not complete the response.

12. Facts / Inference / Hypothesis

Facts

  • Sophos analyzed a Linux implant built for compromised BIG-IP APM environments and describes it as belonging to the same malware family that ESET named PoisonedRefresh.
  • The first-stage installer/deployment component modifies /usr/sbin/httpd, persists in BIG-IP upgrade images, changes SELinux settings, and deploys the second stage.
  • The second stage runs early using a custom ELF loader and a __libc_start_main hook, then hooks apr_dso_load to wait for libphp.
  • It intercepts mmap() for three files, including apm_css.php3, adding a PHP web shell only to their in-memory contents without changing the files on disk. It decrypts requests containing an identifying marker, executes them through eval(), and responds with HTTP 201 and text/css.
  • The implant can also launch /bin/bash through an authenticated UNIX domain socket. CVE-2025-53521 is suggested as a possible initial entry point, but the entry path for this sample has not been established.

Inference

  • The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (medium confidence): CVE-2025-53521 may have provided initial access, but this is unconfirmed for the individual sample.
  • T1505.003 Server Software Component: Web Shell (high confidence): A web shell is injected into the in-memory contents of legitimate PHP files.
  • T1055 Process Injection (high confidence): Apache/libphp runtime memory and function calls are modified.
  • T1027 Obfuscated Files or Information (high confidence): RC4 conceals strings used by the malware.

14. Unknowns and Further Investigation

  • The exact initial entry path and attacker identity in individual compromises.
  • The separate component that connects to the UNIX domain socket.
  • The number of affected appliances, commands executed, and scope of stolen data.

15. Impact on SOCs and Organizations

Organizations operating BIG-IP APM should go beyond checking patched versions: retrospectively investigate the integrity of httpd and upgrade images, Apache worker memory behavior, and POSTs to .php3 files. Assuming the perimeter appliance has been compromised, investigate across IdP, VPN, sessions, administrative credentials, and internal connections.

16. Audience Summaries

  • SOC: On the same appliance, correlate httpd modification and startup, memory changes after libphp loads, and POSTs to the targeted PHP files.
  • Administrators: Apply F5’s fix for CVE-2025-53521 and investigate for compromise; a version upgrade alone does not complete the response.
  • Users: Because the activity blends into normal web responses, CSS responses and the service may appear normal to users.

Top comments (0)