Stealthy Rootkit Targets F5 BIG-IP to Intercept Identity Tokens

A new Linux rootkit targeting F5 BIG-IP Access Policy Management (APM) environments can hide malicious web shells within a system’s memory, allowing attackers to bypass conventional file-based security tools.

Sophos researchers discovered the malware, which uses custom ELF loading, function hooking, and runtime code patching to establish persistent access. The implant appears tailored specifically to BIG-IP APM webtop environments rather than being a generic Apache or PHP attack.

In-Memory Stealth Bypasses File Scans

Rather than dropping a suspicious PHP file onto the server, the rootkit hooks the Apache PHP-loading process and modifies how selected files are presented to the running process. The implant specifically targets three legitimate PHP files used by the BIG-IP APM webtop environment: apm_css.php3, full_wt.php3, and webtop_popup_css.php3.

When PHP attempts to memory-map one of these files as part of its routine runtime, the rootkit intercepts the operation and creates a modified in-memory version containing the malicious web shell alongside the legitimate script. Because the file on disk remains unchanged, file-integrity monitoring and standard filesystem scans will show the system as clean even while it is compromised.

Sean Malone, chief information security officer at BeyondTrust, noted that this technique defeats a fundamental assumption used by many incident response playbooks: that the file on disk accurately represents what the server is running.

Identity and Credential Risks

The malware also establishes a secondary access mechanism through a local UNIX socket instead of a conventional TCP listener. Once authenticated, this socket can provide an interactive /bin/bash session, providing attackers with a way to access the system while avoiding network-based detection.

The implications of a compromise extend beyond the F5 appliance to the broader enterprise identity infrastructure. Agnidipta Sarkar, chief evangelist at ColorTokens, warned that an attacker with access to BIG-IP APM can intercept single sign-on (SSO) tokens and credentials, inject policy decisions, and move laterally to downstream applications or SaaS tenants that trust the appliance.

Vulnerability and Mitigation

The activity has been linked to the exploitation of CVE-2025-53521, an unauthenticated remote code execution (RCE) vulnerability affecting BIG-IP APM when an access policy is configured on a virtual server.

Security experts recommend that defenders investigate systems that were vulnerable prior to patching, as applying the fix does not rule out an earlier compromise. Organisations should combine F5’s indicators of compromise with memory and behavioural telemetry, as file scans alone may fail to detect the rootkit’s in-memory activity.