PoisonedRefresh: Linux Shell Backdoors F5 BIG-IP Memory
Researchers identified a stealthy Linux implant named PoisonedRefresh that exploits critical vulnerabilities in F5 BIG-IP Access Policy Manager systems.
Security researchers have detailed a new Linux malware known as PoisonedRefresh. This implant targets F5 BIG-IP Access Policy Manager systems by injecting PHP web shells directly into server memory. SophosLabs analyzed a recovered sample and explained the mechanism. The malware exploits CVE-2025-53521, a critical unauthenticated remote code execution vulnerability within specific access policy configurations. It manipulates Apache and PHP processes to alter scripts only when mapped into memory. Researchers identified three targeted legitimate files: apmcss.php3, fullwt.php3, and webtoppopupcss.php3. When a PHP application opens one of these files, the malware records its file descriptor. This allows it to intercept subsequent memory-mapping operations. The result is an altered in-memory copy containing the malicious shell while the original filesystem remains intact. F5 confirmed exploitation of this flaw and linked compromise activity to a specific cluster tracked as c05d5254. The injected code reads raw request data, checks for a predefined marker, decrypts content, and passes it to PHP execution. This technique bypasses standard filesystem checks used by defenders.
