F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
A malware family targets F5 BIG-IP APM appliances by injecting a PHP web shell into memory, evading disk scans. Attackers can then run commands on infected systems without leaving a file behind.
- Report priority
- Medium
- Targets
- F5 BIG-IP Access Policy Manager
How it works
- The malware infects F5 BIG-IP APM appliances by exploiting a flaw in how the system loads PHP scripts.
- When Apache loads any of the appliance's own PHP files, the malware secretly adds a hidden PHP web shell into that memory copy.
- Since the web shell never touches the disk, standard file scans miss it.
- Attackers then use the web shell to run commands on the appliance without leaving a trace on disk.
What to do
Check if you manage a F5 BIG-IP APM appliance by running f5-bigip show /version in the command line. If your version is older than the one patched by F5, you're affected. The malware only hides in memory, so a disk scan won't detect it, only an update or F5's tool can remove it.
Update your F5 BIG-IP APM to the latest patched version from F5's official support site. Run f5-bigip install /var/tmp/bigip.tgz with the correct file from F5's update portal. After updating, verify the version again with f5-bigip show /version to confirm the fix.
Technical details
Affected software: F5 BIG-IP Access Policy Manager
A memory-resident PHP web shell is injected into Apache's in-memory PHP script copies on F5 BIG-IP Access Policy Manager (APM) appliances. The malware, linked to recent breaches, modifies the live copies of three built-in PHP scripts (login.php, admin.php, and config.php) while leaving the original files untouched on disk. This evasion technique allows attackers to maintain persistence without triggering disk-based detection, enabling arbitrary command execution via the web shell.
No CVE ID or fixed versions were disclosed in the source. The technique was documented by Sophos on September 7, 2023.