Kiran 
A newly dissected Linux implant is rewriting the rules for what a “web shell” can look like and, in the process, exposing a dangerous blind spot in how enterprises monitor their servers.
Researchers at Sophos X-Ops have published a deep technical analysis of malware found on compromised F5 BIG-IP Access Policy Management (APM) systems that never writes its payload to disk.
For years, defenders have hunted web shells by scanning file systems for suspicious scripts sitting in web-accessible folders. This new implant breaks that model entirely.
Fileless PHP Rootkit Hides in BIG-IP Servers
Instead of dropping a PHP file, it hijacks Apache’s PHP module (libphp) in memory and injects its web shell directly into the in-memory representation of legitimate files, specifically three BIG-IP web top assets: apm_css.php3, full_wt.php3, and webtop_popup_css.php3. The files on disk stay clean. What Apache actually executes is something else entirely.
Sophos links the activity to systems affected by CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM that F5 has tied to a cluster it tracks as c05d5254.
The malware appears to be a second-stage payload, deployed by a separate installer component that infects /usr/sbin/httpd and survives BIG-IP upgrade cycles, suggesting a deliberately staged, persistent campaign rather than opportunistic tampering.
The implant’s tradecraft reads like a masterclass in Linux evasion. It replaces the normal _start → __libc_start_main → main() execution path with a custom ELF loader that reopens its own binary via /proc/self/exe, unpacks an embedded original executable, and hooks __libc_start_main so its code runs before the legitimate application does.
It then hooks Apache’s apr_dso_load function to wait patiently until the PHP module actually loads, activating only in the environment in which it was built.
Once libphp is present, the malware parses /proc/self/maps to pinpoint the module’s memory range, flips its protections to writable, patches relocation entries to hijack calls to open, mmap, and related APIs, then restores normal permissions.
This lets it intercept file operations tied to the three target PHP files and prepend a hidden web shell the moment they’re mapped into memory, all while operational strings stay RC4-encrypted (using the hardcoded key TrswBWIl90Z5e38n) until runtime.
Beyond the HTTP-driven shell, the malware also opens a local UNIX domain socket at /run/bigtlog.pipe, offering attackers an interactive /bin/bash session behind a password token with no TCP port ever exposed to the network.
Sophos, which detects the threat as Linux/Agnt-IC, notes overlapping findings with ESET’s independently discovered “PoisonedRefresh” cluster, reinforcing that this is an active, multi-vendor-observed threat rather than a one-off curiosity.
The bigger takeaway for defenders is architectural. Filesystem integrity checks, long the backbone of web shell detection, simply can’t see this threat because there’s nothing malicious to find on disk.
Sophos recommends correlating web-layer anomalies (like .php3 requests returning HTTP 201 with text/css headers), process behavior (/proc/self/maps reads followed by memory permission changes), and host artifacts (the bigtlog.pipe socket) rather than relying on any single layer.
Enterprises running affected BIG-IP APM versions should prioritize F5’s remediation and compromise-assessment guidance over generic Apache hardening guidance.
Sophos also suggests restricting .php3 execution where feasible, tightening ptrace scope, and building memory-aware incident response playbooks that compare on-disk file contents against what’s actually running in process memory since, as this case proves, the two can now tell very different stories.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
