Actor Profile

Sophos is a cybersecurity vendor that published technical analysis on September 7, 2026, examining malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. Sophos is the researcher/defender in this context, not the threat actor. The actual threat actor behind the intrusions remains unattributed in the provided reporting. The malware, tracked by F5 as c05d5254 and by ESET as PoisonedRefresh, is linked to exploitation of CVE-2025-53521, a critical remote code execution vulnerability in BIG-IP APM. The attacker's motivation appears to be establishing persistent, covert access to network infrastructure devices commonly deployed in large organizations, particularly in the technology sector.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Exploitation of CVE-2025-53521 (CVSS 9.8), an unauthenticated remote code execution vulnerability in F5 BIG-IP APM (T1190: Exploit Public-Facing Application). Persistence: Modification of /usr/sbin/httpd (Apache binary) to inject malicious code that executes before legitimate Apache code (T1554: Compromise Host Software Binary). Defense Evasion: Memory-only web shell injection that modifies in-memory copies of PHP scripts (apm_css.php3, full_wt.php3, webtop_popup_css.php3) while leaving disk files clean, evading file integrity checks (T1027: Obfuscated Files or Information, T1562.001: Disable or Modify Tools via SELinux disablement). Execution: Hooking apr_dso_load function to intercept PHP module loading, rewriting file operation calls to inject web shell at runtime (T1055: Process Injection). Command and Control: Web shell accepts encrypted commands via HTTP POST with CSS content-type masquerading (T1071.001: Application Layer Protocol - Web Protocols, T1001.002: Steganography). Local socket at /run/bigtlog.pipe provides interactive bash shell access (T1059.004: Unix Shell). Lateral Movement: Infection of installation media (umount, httpd, rc.local in BIG-IP install images) to propagate malware to other systems during deployment.

Targets & Patterns

The malware targets F5 BIG-IP Access Policy Manager appliances, which are widely deployed network infrastructure components, especially in large organizations according to the UK National Cyber Security Centre. Targeted sectors include Technology and Network Infrastructure. These devices are high-value targets because they sit at network perimeters, handle authentication and access control, and provide attackers with strategic positioning for further network compromise. The vulnerability (CVE-2025-53521) affects appliances where a BIG-IP APM access policy is configured on a virtual server, requiring no authentication to exploit. Affected versions span 15.1.0 through 17.5.1, representing a broad attack surface. The attacker's focus on memory-resident techniques and installation media infection suggests intent to maintain long-term, difficult-to-detect access to critical infrastructure.

Historical Context

F5 first disclosed CVE-2025-53521 on October 15, 2025, initially classifying it as a denial-of-service vulnerability. On March 27, 2026, F5 reclassified it as remote code execution after discovering active exploitation, and published indicators of compromise for malware tracked as c05d5254. CISA added the vulnerability to its KEV catalog the same day, mandating federal agency remediation by March 30, 2026. F5's March advisory noted that changes to the three PHP scripts alone do not indicate compromise, and that web shells "have been observed to work in memory only." ESET published analysis of related samples in April 2026, naming the malware PoisonedRefresh and documenting the installer's infection of installation media. Sophos's September 7, 2026 analysis provides the technical explanation for how the memory-only web shell operates, reconciling F5's earlier statements about both disk-based and memory-only variants. The patch fixing this vulnerability was released in October 2025, nearly a year before the Sophos analysis, yet exploitation continued through at least March 2026.

Defensive Recommendations

  • Immediately patch F5 BIG-IP APM to fixed versions (17.5.1.3, 17.1.3, 16.1.6.1, 15.1.10.8) if running vulnerable releases 15.1.0-17.5.1; prioritize appliances with APM access policies on virtual servers
  • Verify integrity of /usr/sbin/httpd and /usr/bin/umount binaries against known-good copies using hash comparison and sys-eicheck tool; investigate size/timestamp mismatches (T1554 detection)
  • Monitor for HTTP 201 responses with CSS content-type from BIG-IP appliances, especially when combined with unusual request patterns; inspect raw POST body content for encrypted payloads (T1071.001 detection)
  • Check for presence of /run/bigtlog.pipe or /run/bigstart.ltm files; monitor Apache worker processes reading /proc/self/maps or changing memory permissions around libphp module (T1055 detection)
  • Review /var/log/auditd for SELinux disablement events, /var/log/restjavad-audit for localhost iControl REST API access, and /var/log/audit for base64-encoded bash commands executed via iControl REST (T1562.001 and T1059.004 detection)
  • Conduct memory forensics on suspected compromised appliances, as file-based integrity checks will not detect the memory-resident web shell; compare in-memory PHP script content against disk versions