Executive Summary
A sophisticated malware campaign targeting F5 BIG-IP Access Policy Manager appliances exploits CVE-2025-53521 to inject PHP web shells directly into memory rather than storing them on disk. The malware, tracked as c05d5254 and PoisonedRefresh, hooks Apache functions to modify three specific PHP scripts in memory when loaded, enabling command execution through normal web requests while evading traditional file-based detection. The attack chain begins with exploitation of the critical remote code execution vulnerability (CVSS 9.8) and establishes persistence through infected system binaries and installation media.
This incident highlights the evolution of fileless malware techniques and the growing sophistication of infrastructure-focused attacks. As organizations increasingly rely on application delivery controllers and load balancers for critical services, attackers are developing advanced evasion techniques that challenge traditional security monitoring approaches, making network-level visibility and behavioral analysis essential for detection.
Why This Matters Now
Memory-resident malware attacks are becoming increasingly sophisticated, targeting critical network infrastructure components that traditional endpoint detection tools cannot effectively monitor. This technique represents a significant evolution in evasion tactics that organizations must prepare for immediately.
Attack Path Analysis
Attackers exploited CVE-2025-53521 in F5 BIG-IP APM to achieve remote code execution without authentication, then escalated privileges by disabling SELinux and infecting critical system binaries. The malware established persistent command and control through memory-resident PHP web shells that evade disk-based detection, while maintaining covert channels via local sockets. Data exfiltration occurred through disguised HTTP requests appearing as CSS stylesheet requests, with the malware designed to survive system upgrades and spread through installation media.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers exploited CVE-2025-53521, a critical remote code execution vulnerability in F5 BIG-IP APM with CVSS score 9.8, requiring no authentication when access policy is configured on virtual server
Related CVEs
CVE-2025-53521
CVSS 9.8A remote code execution vulnerability in F5 BIG-IP Access Policy Manager (APM) allows unauthenticated attackers to execute arbitrary code on systems with APM access policy configured on virtual servers.
Affected Products:
F5 Networks BIG-IP Access Policy Manager – 17.5.0-17.5.1, 17.1.0-17.1.2, 16.1.0-16.1.6, 15.1.0-15.1.10
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Web Shell
Dynamic-link Library Injection
Disable or Modify System Firewall
Deobfuscate/Decode Files or Information
Reflective Code Loading
Unix Shell
Dynamic Linker Hijacking
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – External and Internal Penetration Testing
Control ID: 11.3.1
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Third-party Risk
Control ID: Article 21
CISA ZTMM 2.0 – Asset Management
Control ID: ZT.AM-2
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21.2.a
NIST SP 800-53 – Malicious Code Protection
Control ID: SI-3
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
F5 BIG-IP APM web shell malware threatens critical financial infrastructure through memory-resident attacks, bypassing disk-based detection while compromising secure access management systems.
Health Care / Life Sciences
Memory-injected PHP web shells in F5 appliances risk patient data exposure and HIPAA violations through compromised access policy management in healthcare networks.
Government Administration
CISA-catalogued F5 BIG-IP vulnerability enables remote code execution against government networks, with memory-resident malware evading traditional security scanning methods completely.
Telecommunications
F5 BIG-IP APM compromise threatens telecom infrastructure through stealthy web shells, enabling lateral movement and command-and-control activities within critical network segments.
Sources
- F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scanshttps://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.htmlVerified
- F5 Security Advisory - CVE-2025-53521 Remote Code Execution Vulnerabilityhttps://my.f5.com/manage/s/article/K000156741Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Sophos Analysis - Dissecting a PHP Web Server Rootkithttps://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkitVerified
- F5 Indicators of Compromise for c05d5254 Malwarehttps://my.f5.com/manage/s/article/K000160486Verified
- Ireland NCSC Advisory on CVE-2025-53521https://ncsc.gov.ie/pdfs/2603311419_CVE-2025-53521.pdfVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely reduce the blast radius of this F5 BIG-IP compromise through network segmentation and controlled communications. Zero Trust segmentation could constrain lateral movement and limit the scope of data exfiltration through policy-enforced network boundaries.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network segmentation would likely limit the attacker's ability to reach additional infrastructure components from the compromised F5 device, reducing the initial attack surface for subsequent exploitation attempts.
Control: Zero Trust Segmentation
Mitigation: Identity-aware access controls would likely reduce the scope of privileged operations the compromised system could perform against other network resources, limiting cross-system administrative access even with local root privileges.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the compromised system's ability to reach file servers, deployment systems, or other infrastructure hosting installation media, reducing propagation pathways.
Control: Multicloud Visibility & Control
Mitigation: Traffic inspection and policy enforcement would likely constrain command and control communications by blocking or detecting suspicious HTTP patterns that deviate from legitimate CSS request behaviors.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely constrain data exfiltration by limiting outbound communication paths and enforcing inspection of suspicious HTTP response patterns that exceed normal CSS transfer characteristics.
Even with persistent compromise of the F5 device, network segmentation boundaries would likely contain the threat impact to the immediate infrastructure segment, reducing access to sensitive data repositories and critical business systems.
Impact at a Glance
Affected Business Functions
- Network Access Control
- Remote Access Services
- Web Application Delivery
- Network Security Infrastructure
Estimated downtime: 7 days
Estimated loss: N/A
Potential exposure of network traffic, authentication credentials, and internal network access through compromised F5 BIG-IP APM appliances. Memory-resident web shell provides persistent backdoor access to critical network infrastructure components.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS (Suricata) to detect and block known exploit patterns targeting CVE-2025-53521 and similar vulnerabilities before they reach critical infrastructure
- • Deploy Zero Trust Segmentation with least privilege policies to limit blast radius if F5 BIG-IP or similar appliances are compromised
- • Enable Egress Security & Policy enforcement to detect and block suspicious outbound communications disguised as legitimate web traffic (HTTP 201 CSS responses)
- • Implement Multicloud Visibility & Control to monitor for anomalous interactions and repeated malformed requests targeting management interfaces
- • Deploy Threat Detection & Anomaly Response capabilities to baseline normal Apache worker behavior and alert on suspicious activities like memory permission changes and socket binding
