F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
Sophos revealed that malware targeting F5 BIG-IP APM appliances injects a PHP web shell directly into Apache's memory at runtime, bypassing traditional disk-based file integrity checks The malware hooks the `apr_dso_load` function in Apache, intercepts PHP module loading, and rewrites file-mapping syscalls to prepend the web shell to three specific PHP scripts in memory only The infection chain begins with an installer (named "umount") that modifies the Apache binary at `/usr/sbin/`, disables SE
Analysis
TL;DR
- Sophos revealed that malware targeting F5 BIG-IP APM appliances injects a PHP web shell directly into Apache's memory at runtime, bypassing traditional disk-based file integrity checks
- The malware hooks the
apr_dso_loadfunction in Apache, intercepts PHP module loading, and rewrites file-mapping syscalls to prepend the web shell to three specific PHP scripts in memory only - The infection chain begins with an installer (named "umount") that modifies the Apache binary at
/usr/sbin/, disables SELinux, and infects/usr/bin/umountandrc.localinside BIG-IP install images for lateral spread - A secondary backdoor opens a local Unix socket at
/run/bigtlog.pipe, binding it to/bin/bashfor interactive shell access without opening any network port - The underlying vulnerability, CVE-2025-53521, was initially disclosed as a DoS flaw in October 2025 and later reclassified as an unauthenticated RCE (CVSS 9.8) actively exploited in the wild
Why It Matters
This attack demonstrates a sophisticated memory-only persistence technique that renders conventional file-integrity monitoring and disk-scanning defenses ineffective, forcing defenders to adopt behavioral and memory-based detection strategies. It also highlights the critical risk of supply-chain-style infection vectors, where infecting BIG-IP install images enables the malware to propagate to newly deployed or rebuilt appliances.
Technical Details
- Memory-injection web shell: The malware hooks
apr_dso_load, locateslibphpin memory via/proc/self/maps, temporarily makes those pages writable, rewrites the open/size/map syscalls used by PHP, and restores original permissions—ensuring the web shell is prepended to the three target scripts (apm_css.php3,full_wt.php3,webtop_popup_css3) only in memory, leaving disk files untouched. - Web shell behavior: The shell reads raw HTTP request bodies, checks for a short marker string, decrypts and executes the remainder, and responds with HTTP 201 and a CSS content type to blend in with legitimate stylesheet requests.
- Local backdoor: A Unix domain socket at
/run/bigtlog.pipeaccepts a fixed token and connects directly to/bin/bash, providing interactive root shell access without any network listener. - Installer and persistence: The "umount" installer runs as root, disables SELinux, infects the Apache binary at
/usr/sbin/by prepending malicious code, and also infectsumountandrc.localinside BIG-IP install images to spread via installation media. - Affected versions: CVE-2025-53521 impacts BIG-IP APM versions 17.5.0–17.5.1, 17.1.0–17.1.2, 16.1.0–16.1.6, and 15.1.0–15.1.10; patches were released in October 2025 (e.g., 17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8).
- Detection indicators: Presence of
/run/bigtlog.pipeor/run/bigstart.ltm, hash/size/timestamp mismatches on/usr/bin/umountor/usr/sbin/, failedsys-eicheck, SELinux disabled via auditd, localhost iControl REST API access, HTTP 201 responses with CSS content type, and anomalous Apache worker memory-permission changes.
Industry Insight
- Organizations relying solely on file-integrity monitoring (e.g., checksums, hash comparisons) against compromised BIG-IP appliances will have blind spots; memory forensics and behavioral detection must be layered into defensive postures.
- The infection of BIG-IP install images represents a supply-chain persistence mechanism that can re-infect patched systems during redeployment—defenders should validate install media integrity and consider air-gapped or verified update pipelines.
- The unauthenticated RCE nature of CVE-2025-53521, combined with its high CVSS score and CISA Known Exploited Vulnerabilities listing, makes immediate patching non-negotiable for any organization running affected BIG-IP APM versions.
Disclaimer: The above content is generated by AI and is for reference only.