Linux Rootkit Targets F5 BIG-IP APM, Lives in Memory
Attackers are breaching F5 BIG-IP APM devices to deploy a Linux rootkit that hooks PHP file loading and injects a fileless web shell into memory, leaving no disk artifacts.
Morgan "airgap" ReyesObserved. A Linux rootkit targeting F5 BIG-IP APM environments intercepts PHP file loading at the process level and injects a web shell directly into memory, per BleepingComputer. No malicious code written to disk. Standard file-based detection doesn’t catch it.
Confidence: BleepingComputer reporting sourced to active research. CVE designation and attribution: not available in source summary at time of publication.
What the rootkit does
The technique is file-loading interception. By hooking into the PHP runtime’s file-load path, the rootkit can inject a web shell into PHP’s execution context without creating files in the web root or anywhere else on disk. The result is a persistent backdoor that survives routine file-integrity checks because there’s nothing to check.
This class of attack, fileless persistence via in-memory injection, is documented in prior rootkit campaigns but appearing in an enterprise network appliance context is notable. BIG-IP APM is an access policy manager used for VPN, remote access, and application delivery in enterprise environments. A persistent backdoor in that layer sits in front of authenticated access flows.
Context: F5 BIG-IP targeting history
F5 BIG-IP vulnerabilities have drawn targeted exploitation before. The max-severity BIG-IP iControl REST authentication bypass published in July 2026 drew significant attention. The rootkit now being observed is a separate development: initial access is not described in available sources, but the technique for maintaining persistence has been documented.
Administrators should treat this as evidence of a broader campaign pattern targeting network edge appliances with in-memory persistence. Related: Nightmare Eclipse: Zero-Days Hit CrowdStrike, Nvidia, Avast documents a similar pattern of threat activity targeting security tooling.
More details expected as research is published. Will update when a CVE is assigned.
Related: F5 BIG-IP’s Max-Severity Auth Bypass, Explained | JSCeal Malware Bypasses Google Auth with Stolen Cookies | N-able N-central Auth Bypass Added to CISA KEV
Found this useful? Share it.
