SophosLabs published technical analysis on September 8 of a fileless Linux rootkit dubbed PoisonedRefresh that injects PHP web shells directly into F5 BIG-IP Access Policy Manager Apache server memory, leaving no disk artifacts and making detection through traditional file-based scanning extremely difficult. F5 confirmed active exploitation of BIG-IP vulnerabilities used to deploy the rootkit, which Sophos tracks as Linux/Agnt-IC and ESET also documented in separate research.
PoisonedRefresh Injects Web Shells Directly into BIG-IP APM Apache Memory
The rootkit operates entirely in memory, injecting PHP web shells directly into the Apache server process running on F5 BIG-IP Access Policy Manager appliances. This memory-resident technique avoids writing malicious code to disk, where file integrity monitoring, antivirus scans, and traditional forensic analysis would detect it. The injected web shells provide persistent backdoor access to compromised BIG-IP appliances through standard HTTP requests.
Fileless Persistence Makes Detection Extremely Difficult
PoisonedRefresh’s memory-only persistence makes it extremely difficult to detect using conventional security tools that scan files or monitor disk writes. The web shell exists only in the running Apache process’s memory space, disappearing if the process restarts but re-injecting if the rootkit’s memory-resident loader remains active. Organizations scanning BIG-IP appliances for compromise must perform memory forensics rather than file-based analysis to identify the infection.
F5 Confirmed Active Exploitation of BIG-IP Vulnerabilities Used for Deployment
F5 confirmed active exploitation of BIG-IP vulnerabilities that attackers use to deploy PoisonedRefresh. The rootkit requires initial system access to inject code into the Apache process, and attackers obtain this access by exploiting authentication bypass or remote code execution vulnerabilities in BIG-IP software. F5 urged customers to apply available security patches addressing the exploited flaws.
Network Access Control Infrastructure Weaponized for Long-Term Attacker Presence
F5 BIG-IP Access Policy Manager serves as network access control infrastructure in many enterprise environments, managing VPN connections, application access policies, and authentication workflows. Compromise of these appliances provides attackers with visibility into authentication traffic, the ability to intercept credentials, and persistent backdoor access to critical network infrastructure.
BIG-IP APM appliances sit at the boundary between external users and internal resources, enforcing authentication and authorization decisions for VPN access, web application access, and federated single sign-on. The appliances handle credential verification, session management, and policy enforcement, making them high-value targets for attackers seeking persistent access to enterprise networks.
The memory-injected web shell grants remote command execution on the compromised appliance, enabling attackers to modify access policies, harvest credentials from passing authentication flows, and maintain long-term presence even if other compromise artifacts are discovered and removed. The fileless nature of the infection makes remediation challenging — simply deleting malicious files does not remove the threat.
Because PoisonedRefresh operates entirely in memory, rebooting the compromised appliance may remove the web shell temporarily, but if the rootkit’s injection mechanism persists or the initial compromise vector remains unpatched, the web shell will be re-injected after reboot. Organizations must identify and remediate the initial access vulnerability, apply F5’s security patches, and perform thorough memory forensics to confirm removal rather than simply restarting affected systems and assuming the infection is cleared.
SophosLabs published detailed technical analysis of the rootkit’s injection mechanism and memory persistence techniques. Organizations with BIG-IP deployments should perform memory forensics on appliances, monitor for anomalous Apache processes or unexpected network connections from BIG-IP systems, and apply F5’s security patches. Network segmentation that isolates BIG-IP management interfaces and restricts outbound connections from appliances can limit the rootkit’s command-and-control capabilities even if initial compromise occurs.
The fileless rootkit approach PoisonedRefresh uses reflects a broader trend in malware design toward techniques that evade traditional detection methods. Antivirus and endpoint detection tools historically focused on scanning files written to disk, making file-based malware the primary detection target. Fileless malware defeats this approach by operating entirely in memory, leaving no disk artifacts for file scanners to detect. Security teams must supplement file-based detection with memory forensics, behavioral monitoring, and network traffic analysis to identify fileless threats like PoisonedRefresh.
