Security researchers have identified a stealthy Linux rootkit being planted on hacked F5 BIG-IP Access Policy Manager devices, giving attackers a way to hold onto compromised enterprise networks without leaving an obvious file behind. ESET, which named the implant "PoisonedRefresh," said it functions as a second-stage payload following initial exploitation of a critical remote-code-execution flaw, tracked as CVE-2025-53521, in F5's access-management software.
Rather than dropping a malicious PHP file that antivirus tools or file scans could catch, the rootkit modifies the Apache web server process itself and injects a web shell only into memory, intercepting how three specific PHP files used by the APM interface are loaded and executed. That means the code a scanner reads on disk can differ entirely from what the server is actually running — a technique BleepingComputer reported makes the implant unusually difficult to detect through conventional means.
Built to Persist
The rootkit hides its operational strings using RC4 encryption, hooks a low-level system function to begin running before the host application's own code starts, alters SELinux configurations to weaken protections, and opens a password-protected local backdoor over a Unix socket. It is also built to survive routine BIG-IP software upgrades — a persistence mechanism that suggests a well-resourced, targeted intrusion rather than opportunistic, broad scanning, according to ESET's analysis. The firm said it found no evidence tying the activity to a previously known threat actor.
F5's BIG-IP APM appliances are widely deployed by banks, government agencies and large enterprises to enforce access policies for internal applications. As of September 7, roughly 795 vulnerable BIG-IP APM instances remained reachable on the public internet, according to researcher scans cited in coverage of the campaign. CVE-2025-53521 was originally classified as a lower-severity denial-of-service issue when first disclosed in March before being reclassified as a critical remote-code-execution flaw.
F5 has published patches for the vulnerability, and researchers are urging organizations running BIG-IP APM to update immediately and hunt for signs of compromise, including Apache worker processes reading unusual memory locations and unexpected POST requests to the targeted management endpoints. The incident adds to a run of attacks this year against enterprise network and remote-access appliances, a category that has become one of the most consistently targeted entry points into corporate networks.
