A Rootkit Now Hides Inside F5 Access Manager Memory

SophosLabs and ESET researchers have identified a stealthy Linux rootkit, named PoisonedRefresh by ESET and tracked by Sophos as Linux/Agnt-IC, targeting F5 BIG-IP Access Policy Manager devices. The rootkit injects a PHP web shell directly into server memory rather than writing it to disk, which lets it evade file-based web shell scanning. It exploits CVE-2025-53521, a BIG-IP APM vulnerability that F5 originally classified as a denial-of-service issue before recategorizing it as unauthenticated remote code execution. The UK’s National Cyber Security Centre says plainly that “a previously disclosed vulnerability in BIG-IP APM has been recategorised as an unauthenticated remote code execution vulnerability,” and that “all organisations using BIG-IP APM are affected by this vulnerability.”

The recategorization matters as much as the rootkit itself. Organizations that triaged this bug when it first appeared as a denial-of-service issue, typically a lower-urgency patch, are now sitting on an unauthenticated RCE they may not have prioritized, on an access-management appliance that by design sits at the network edge deciding who gets in. That combination, an internet-facing identity gateway plus in-memory malware that standard file scanning will not catch, is precisely the profile that turns a single unpatched box into a foothold across an entire remote-access environment.

The original insight defenders should take from this one is procedural, not just technical: severity reclassifications on already-patched CVEs need their own alerting path. A bug that entered your ticketing system as low-priority does not get re-reviewed just because the vendor quietly updated its advisory months later. NCSC’s guidance points organizations to F5’s own remediation and compromise-assessment steps rather than generic Apache or PHP hardening, and recommends runtime and memory inspection over file-based scanning alone, since this malware is built specifically to survive the latter.

Source: National Cyber Security Centre (UK)