PoisonedRefresh: The Memory-Only Web Shell That Evades Disk Forensics on F5 BIG-IP APM

On September 7, 2026, SophosLabs published its analysis of PoisonedRefresh, a Linux implant that compromises F5 BIG-IP APM servers by exploiting CVE-2025-53521. The malware leaves no disk artifacts: it injects the web shell directly into the memory of Apache worker processes, rendering file-integrity detection useless. For security teams, this creates a new problem: patching the system does not remove the active implant, which continues to operate in RAM until the service is restarted.

How the Memory-Only Injection Works in Apache Processes

The core mechanism of PoisonedRefresh is the runtime hooking of library functions in libphp. According to the SophosLabs analysis shared with GBHackers, the malware intercepts open, close, mmap, and __fxstat in the Apache PHP module. When the worker process loads legitimate BIG-IP APM webtop PHP files into memory — specifically apm_css.php3, full_wt.php3, and webtop_popup_css.php3 — the malicious payload is injected during the mmap() phase.

The on-disk files remain unaltered and benign. The Apache process instead executes a modified in-memory version that reads commands from php://input, verifies a magic prefix, decrypts the content with RC4, and executes it via eval(). The HTTP response is masked with status code 201 and Content-Type text/css; charset=utf-8, mimicking legitimate stylesheet traffic.

This approach nullifies every file-based integrity check. As SophosLabs noted, quoted by SecurityOnline: "The on-disk file does not need to contain the final web shell content at all; execution follows from the modified in-memory representation created by the implant at runtime."

The Custom ELF Loader and Persistence Beyond Reboot

The analyzed sample, with SHA-256 hash 26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9, is a stripped, statically linked binary. To conceal its execution, PoisonedRefresh implements a custom ELF loader that intercepts __libc_start_main: the malware preserves the original libc startup routine, reopens its own executable via /proc/self/exe, maps an embedded executable within itself, and redirects execution before the normal C library initialization.

A parallel Sophos analysis of a related sample in the umount binary revealed a separate first-stage installer. This component infects /usr/sbin/httpd, installs itself in /mnt/tm_install to survive system upgrades, and modifies SELinux policies to evade security controls. The malicious prefix of size 0x5430 in the infected httpd matches the embedded payload in the umount sample, confirming the relationship between the two components.

"Our analysis suggests the sample discussed here represents a second-stage payload; during parallel analysis of a related umount sample, we noted a distinct installer/propagation component" — SophosLabs

Dual Access Channels: HTTP Web Shell and UNIX Domain Socket

PoisonedRefresh does not rely on a single command vector. Beyond the PHP-injected web shell, the malware creates a local UNIX domain socket at /run/bigtlog.pipe. Activation occurs via a hook on apr_time_now, an Apache Portable Runtime function: when an authentication condition is met, standard input, output, and error are redirected to /bin/bash, opening an interactive local shell.

The UNIX domain socket requires pre-existing compromised system access or another local access vector. It is not directly network-exposed, but serves as an alternative persistence path should the HTTP web shell be detected and neutralized. The combination of two channels — one camouflaged in web traffic, the other hidden in the local socket filesystem — makes complete eradication particularly complex.

CVE-2025-53521: The Entry Flaw and the c05d5254 Campaign Context

The vulnerability exploited for initial access is CVE-2025-53521, an unauthenticated RCE in F5 BIG-IP APM with an access policy configured on a virtual server. According to NVD, the CVSS 4.0 score is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability affects branches 15.1.x, 16.1.x, 17.1.x, and 17.5.x; patched versions are 15.1.10.8, 16.1.6.1, 17.1.3, and 17.5.1.3.

F5 has confirmed in-the-wild exploitation of this vulnerability and linked the activity to the campaign tracked internally as c05d5254. The CVE record is listed in the CISA Known Exploited Vulnerabilities catalog. ESET independently analyzed the same malware, confirming the 'PoisonedRefresh' designation and observing behaviors overlapping those documented by Sophos.

What to Do Now

• Perform compromise assessments on already-patched BIG-IP APM servers: the memory-only implant survives patching and requires verification of Apache process memory, not just on-disk file integrity.
• Monitor for behavioral anomalies in Apache worker processes: fluctuations in libphp memory permissions, repeated accesses to /proc/self/maps by httpd processes, and anomalous mmap allocation patterns on webtop PHP files.
• Analyze HTTP telemetry for responses with status code 201 on PHP endpoints that should return other codes, particularly when accompanied by Content-Type text/css on dynamic resources.
• Check for undocumented UNIX domain sockets in /run/, especially paths named bigtlog.pipe or similar, and inspect Apache processes with open file descriptors pointing to interactive shells.

Why This Changes Everything for Web Shell Detection

PoisonedRefresh marks a discontinuity in the web compromise detection chain. Until now, web shells were by definition on-disk artifacts: anomalous PHP files, suspicious timestamps, static signatures in content. The Sophos-analyzed malware proves this model is obsolete. When the payload resides exclusively in mmap-mapped memory pages and disappears with a process restart, the entire category of disk-centric tools — file-scanning EDR, filesystem integrity monitoring, static sandboxing — loses effectiveness without alternative visibility.

The required shift is both technical and organizational. Teams must integrate process memory detection, syscall tracing, and HTTP behavioral analytics, with instrumentation and skill costs that many organizations have not yet distributed. For security vendors, the challenge is updating detection logic for runtime hooking of shared libraries, a domain previously reserved for advanced rootkit research and now entering the ordinary threat model of perimeter servers.

Sources

• https://gbhackers.com/poisonedrefresh-malware/
• https://www.itsecuritynews.info/poisonedrefresh-malware-backdoors-f5-big-ip-servers-with-memory-only-php-web-shells/
• https://www.infosectoday.io/dissecting-a-php-web-server-rootkit
• https://securityonline.info/php-web-server-rootkit/
• https://www.kobaran.com/poisonedrefresh-malware-hides-inside-apache-memory-while-f5-big-ip-files-stay-clean/
• https://nvd.nist.gov/vuln/detail/CVE-2025-53521
• https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit
• https://gbhackers.com/crafted-jpegs-trigger-php-memory/

Information verified against cited sources and current as of publication.

Sources