A rootkit built to leave nothing for a disk scan to find
Sophos researchers, with the rootkit itself named PoisonedRefresh by ESET, disclosed a fileless implant living inside F5 BIG-IP Access Policy Manager devices, the appliances enterprises, financial institutions, and government agencies use to enforce who gets access to internal applications. An installer component the malware calls "umount" modifies the Apache binary at /usr/sbin/httpd, tampers with rc.local and install images for persistence across upgrades, quietly disables SELinux protections, and drops a second-stage payload that does the real work.
That second stage uses RC4 encryption to hide its operational strings and hooks the C runtime's __libc_start_main function so it executes before the legitimate application even starts. It then hooks Apache's module loader to intercept how the PHP interpreter loads its files, positioning itself to manipulate memory before any code touches disk. This is appliance-level tradecraft, built specifically for a device class that most security teams monitor far less closely than a laptop or a server.
How the web shell hides in plain memory
Rather than dropping a PHP file an antivirus engine could hash and flag, PoisonedRefresh waits for Apache to open three specific legitimate files, apm_css.php3, full_wt.php3, and webtop_popup_css.php3, and intercepts the memory mapping at that moment to splice shell code in ahead of the real content. The files on disk never change. Hash checks, timestamp checks, and traditional file-integrity monitoring all come back clean, because the malicious code exists only in the running process's memory, not in anything a scanner can read from the filesystem.
The implant also opens a Unix domain socket at /run/bigtlog.pipe that, after verifying a token, hands an attacker a direct shell into /bin/bash. Command traffic comes in through encrypted, marker-tagged request bodies, and responses go out with an HTTP 201 status and a CSS content-type header, mimicking the benign traffic those webtop files would normally generate. Every layer of this design assumes a defender is watching the filesystem and the obvious HTTP response codes, and builds around exactly that assumption.
The vulnerability was patched eleven months before this surfaced
The entry point is CVE-2025-53521, a flaw F5 originally classified as a denial-of-service issue in October 2025 before reclassifying it as unauthenticated remote code execution on March 27, 2026. Exploitation requires a BIG-IP APM access policy configured on a virtual server, a common configuration for exactly the access-control use case these devices are bought for. F5 shipped fixes across every supported branch: 17.5.1.3, 17.1.3, 16.1.6.1, and 15.1.10.8. Organizations that patched promptly in October 2025 closed the door before this reclassification even happened, which is the single clearest predictor of who is, and is not, exposed to PoisonedRefresh today.
That timeline matters more than the technical sophistication of the rootkit itself. F5 published a fix in October 2025, nearly a year before this disclosure, yet the exploitation and reclassification history shows attackers had a working path into these devices well before most defenders understood the flaw's real severity. A denial-of-service label buys a lower patch priority than a remote code execution label, and that gap between how a bug is initially scored and what it turns out to enable is exactly where campaigns like this one live. Any team that triaged this CVE by its original October 2025 severity rating, rather than revisiting it after the March 2026 reclassification, likely still has it sitting unpatched somewhere in its BIG-IP fleet nearly a year later, which is precisely the window PoisonedRefresh appears built to exploit.
Detection has to move from disk to memory and logs
Sophos published concrete indicators for teams that cannot rule this out with a patch alone. On disk, watch for the presence of /run/bigtlog.pipe or /run/bigstart.ltm, and for hash, size, or timestamp mismatches on /usr/bin/umount or /usr/sbin/httpd, since the installer does eventually touch those binaries even though the web shell itself stays in memory. A specific SHA-256 hash for the installer component is now public and should go into detection tooling immediately.
In logs, look for failed sys-eicheck integrity checks, iControl REST API calls originating from localhost inside restjavad-audit, SELinux being disabled per auditd records, and base64-encoded commands appearing in audit logs. Behaviorally, HTTP 201 responses carrying CSS content-type headers, Apache worker processes reading /proc/self/maps, and unexpected memory permission changes around libphp are all signals worth alerting on, none of which a conventional file scan would ever surface. None of these indicators require exotic tooling to catch, but all of them require a team to already be logging and reviewing this specific appliance class with the same rigor applied to servers and endpoints, which is exactly the gap PoisonedRefresh was built to exploit and the gap most BIG-IP deployments still carry today.
The decision this puts on every network-edge owner's desk
Patching closes the door, but it does not tell you whether someone already walked through it. Sophos is explicit that post-patch verification requires pulling qkview reports for F5 analysis, comparing what is actually loaded in memory against what sits on disk, or simply isolating and rebuilding devices where compromise cannot be ruled out. That is a materially heavier lift than confirming a patch applied, and it is the right bar for any organization that ran an affected version with APM access policies live between the vulnerability's introduction and the October 2025 fix.
This also fits a broader pattern worth flagging: network-edge appliances, VPN gateways, load balancers, and access managers have become the preferred beachhead for sophisticated intrusions precisely because they sit outside normal endpoint detection coverage and get patched on a slower cadence than servers and workstations. Any CTO who has not extended memory-forensics and log-based hunting to these devices is leaving the softest part of the perimeter unmonitored, regardless of how current the patch level looks on paper this week.
