Hackers Deploy File‑less Linux Rootkit on Compromised F5 BIG‑IP APM Appliances
What Happened — Researchers observed a Linux‑based rootkit that infiltrates F5 BIG‑IP Access Policy Manager (APM) devices. The payload hooks the PHP interpreter, injects a file‑less web shell directly into memory, and avoids writing malicious files to disk, giving attackers persistent, stealthy access.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of un‑patched or un‑monitored application‑delivery infrastructure – a classic failure of a vulnerability‑management control.
- Continuous control‑assurance programs must capture evidence of timely patching, configuration drift detection, and runtime integrity monitoring to prove due diligence.
- Verisq’s Control Mapping capability can automatically correlate remediation tickets with the underlying VCF control “Maintain up‑to‑date software and timely remediation of known vulnerabilities,” providing audit‑ready proof across frameworks.
Who Is Affected – Enterprises that rely on F5 BIG‑IP APM for load balancing, web‑application firewalls, or secure access—spanning finance, telecom, cloud service providers, and large‑scale SaaS operators.
Recommended Actions
- Verify the firmware version on all BIG‑IP APM devices against F5’s latest security advisory.
- Apply any available patches immediately; if none exist, implement compensating controls (e.g., network segmentation, host‑based IDS).
- Enable runtime integrity monitoring and log all PHP execution events for forensic correlation.
- Document remediation steps in your control‑assurance platform to maintain a defensible audit trail.
Technical Notes – The rootkit exploits a privilege‑escalation flaw in the BIG‑IP APM Linux kernel (specific CVE not disclosed in the source). It achieves persistence by hooking the php_module load routine and injecting a shellcode payload that resides only in memory. No data exfiltration was reported, but the foothold enables arbitrary command execution.
Source: BleepingComputer