Threat actors have compromised F5 BIG-IP Access Policy Manager (APM) gateways to deploy PoisonedRefresh (tracked by Sophos as Linux/Agnt-IC), an advanced memory-resident Linux rootkit. Operating as a post-exploitation payload following initial access via CVE-2025-53521, the installer modifies the /usr/sbin/httpd binary and intercepts __libc_start_main. By hooking into the Apache Portable Runtime dynamic module loader (apr_dso_load) upon loading libphp, the rootkit intercepts Apache processes to inject fileless web shells directly into the memory space of legitimate APM scripts, including apm_css.php3, full_wt.php3, and webtop_popup_css.php3.

The rootkit evaluates arbitrary PHP commands from request bodies and returns command output disguised as HTTP 201 Created responses with text/css MIME headers, leaving no disk artifacts for file integrity monitors. Attackers also establish an interactive local shell via a hidden Unix domain socket at /run/bigtlog.pipe, and modify SELinux policies alongside upgrade scripts (umount, rc.local) to persist across BIG-IP system re-images. F5 and threat researchers have urged operators running vulnerable APM versions to inspect process maps and upgrade to remediated firmware.

Why it matters:

• In-memory evasion defeats edge integrity controls: By tampering with dynamic linker routines and injecting web shells exclusively into Apache’s heap space, PoisonedRefresh completely bypasses read-only partition checks and standard disk-based file integrity monitoring (FIM).
• Firmware-persistent appliance compromise: Because the installer hooks system upgrade images and SELinux policies, standard rebooting or routine version updating fails to eradicate the implant; defenders must conduct out-of-band forensic memory dumps and execute full bare-metal reinstallations.