F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7.

When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy held in memory, so a check of the file on disk can come back clean. Those three scripts are the same ones F5 pointed customers to in March, when it said changes to them alone do not show a break-in.

A web shell is usually a small script an attacker drops into a web server's folders to run commands through ordinary web requests. Because it sits on disk, defenders look for it by scanning files and comparing them against known-good copies. That approach does not work here.

As the researchers put it, the web shell "does not need to exist in its final form on disk." The three scripts are apm_css. php3, full_wt. php3 and webtop_popup_css. php3, part of the BIG-IP APM webtop.

F5 named all three in March in a published list of indicators of compromise for the malware it tracks as c05d5254, and said at the time that their presence alone does not point to a security problem.

F5 also said it had seen cases where a web shell was written to disk, but that the web shells "have been observed to work in memory only," which means the files it listed might not be modified. The Sophos analysis explains how both statements can be true at once. Sophos examined a single sample.

Its analysis names no victim and does not say how the sample was obtained. F5 has linked the c05d5254 activity to appliances affected by CVE-2025-53521 , Sophos said. F5 first published that flaw on October 15, 2025, as a denial-of-service problem.

On March 27, 2026, F5 said new information had led it to reclassify the flaw as remote code execution , and that it had been exploited. An attacker needs no login to use it, and F5 rates it 9. 8 on CVSS 3. 1 and 9. 3 on CVSS 4. 0. CISA added it to its Known Exploited Vulnerabilities catalog the same day, giving U. S.

federal civilian agencies until March 30 to act. The patch that fixes this is nearly a year old. Ireland's National Cyber Security Center said in a March 31 advisory that the patch released in October is still valid and will protect against exploitation.

The web shell is the last step in a longer chain, and the earlier steps do touch the disk. Sophos said a separate installer, found in a sample named umount, infects the Apache web server program at /usr/sbin/httpd by adding malicious code to the front of the real file.

The size of that added code matches the payload carried inside the installer, which Sophos said strongly suggests the installer puts it there. Because the malware sits inside the Apache program, it runs before Apache's own code starts.

Sophos said it hooks an Apache Portable Runtime function, apr_dso_load, and does nothing until Apache loads the PHP module, libphp.

Once PHP is loaded, the malware reads /proc/self/maps to find the module in memory, briefly makes those memory pages writable, rewrites the calls the module uses to open, size, and map files, then puts the original permissions back. From that point, it controls what PHP sees when it opens one of the three scripts.

When the file is mapped into memory, the malware places the web shell in front of the original content. The web shell reads the raw body of a request, checks it for a short marker, decrypts the rest, and runs it.

It replies with HTTP status 201 and a CSS content type, so the exchange looks like a request for a stylesheet. The malware also opens a local socket at /run/bigtlog. pipe. After checking for a fixed token, it connects that socket to /bin/bash, giving an interactive shell without opening a network port.

Sophos said it could not find any code in the sample for connecting to that socket, and no other use of the token, so the two ways in look like separate features. It has no evidence either way on whether the attacker reaches the socket through the web shell.

Sophos said its behavioral signals are leads to investigate, not proof on their own, and should be read alongside file, process, and memory evidence. The list below combines them with the indicators F5 published in March. F5's list also includes items the Sophos analysis does not cover, among them /run/bigstart.

ltm and the changes affecting sys-eicheck. Neither account describes the whole intrusion. Patching does not settle whether an appliance was compromised before the patch went on.

Ireland's NCSC said no timeline for exploitation is available, and that it expects some exploitation was or could have been happening before the flaw and its fix were first published in October 2025. Three things are still unknown. F5 has not said when exploitation began.

None of the published advisories or analyses say whether upgrading an appliance to a fixed release removes malware already installed on it, and both Sophos and ESET describe a component designed to survive upgrade images.

And no one has named an attacker: Sophos said it does not have enough evidence to name a group, and ESET said in April that it had not settled the question either. See how to test new CVEs against your environment, confirm what attackers can actually exploit, and fix the exposures that pose the greatest risk.

Learn how to identify exploitable risk faster, prioritize what matters most, and reduce exposure before AI-powered attacks accelerate the threat.