F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
A sophisticated malware, linked to break-ins at F5 BIG-IP APM appliances, hides a PHP web shell in memory, bypassing traditional file-based scanning. The malware, tracked as c05d5254, is injected via a root-level installer that disables SELinux and infects key files. The vulnerability (CVE-2025-53521) allows remote code execution and has been exploited since October 2025. While patching mitigates the risk, it doesn't guarantee that previously compromised appliances are clean, and attackers may still be active. Defenders should actively investigate for signs of compromise, even after patching, using a combination of file integrity checks, memory analysis, and log monitoring.
F5 BIG-IP APM appliances are being targeted by a sophisticated malware that bypasses traditional security measures by hiding a PHP web shell in memory. The malware, tracked as c05d5254, is injected through a root-level installer named ‘umount’ that disables SELinux and infects key files, including /usr/bin/umount and /usr/sbin/httpd. The vulnerability, CVE-2025-53521, was initially classified as a denial-of-service issue by F5 in October 2025, but was later reclassified as remote code execution and exploited since then. The malware operates by hooking an Apache Portable Runtime function, apr_dso_load, and only activates when the PHP module, libphp, is loaded. Once PHP is loaded, the malware reads /proc/self/maps to find the module in memory, briefly makes those memory pages writable, rewrites the calls the module uses to open, size, and map files, then puts the original permissions back. From that point, it controls what PHP sees when it opens one of the three scripts: apm_css.php3, full_wt.php3 and webtop_popup_css.php3. The web shell then reads the raw body of a request, checks it for a short marker, decrypts the rest, and runs it, replying with an HTTP 201 response carrying a CSS content type. It also opens a local socket at /run/bigtlog.pipe, connecting to /bin/bash, giving an interactive shell without opening a network port. Sophos analysis indicates that the attacker may reach the socket through the web shell, but lacks definitive proof. F5's initial advisory stated that the presence of these three scripts alone did not indicate a problem, but Sophos’s analysis explains why: the files do not need to change at all. Ireland’s National Cyber Security Centre (NCSC) advises investigating for compromise regardless of when the system was updated, and recommends rebuilding appliances as a precaution. The UK’s NCSC advises raising a case with F5 after submitting a qkview report to expedite investigation. F5 has not yet determined when exploitation began, and neither the Sophos nor ESET analysis can definitively say whether upgrading an appliance removes malware already installed. The malware is designed to survive upgrade images, and no attacker has been identified.