F5 BIG-IP APM devices hacked to install Linux rootkit
Attackers broke into F5 BIG-IP APM devices and installed a Linux rootkit that hides in memory to steal data and run commands without leaving a file on the disk. This lets them spy on traffic and take control of the device without leaving obvious traces.
- Report priority
- Medium
- Involves
- F5 BIG-IP APM
What is known
- Attackers first compromised F5 BIG-IP APM devices by exploiting a known vulnerability.
- Once inside, they installed a Linux rootkit that hides in the device's memory.
- This rootkit intercepts PHP files being loaded and injects a fileless web shell, malicious code that runs directly in memory without saving to disk.
- This lets them spy on traffic, steal data, and run commands without leaving a file behind, making detection harder.
What to do
Check if you use F5 BIG-IP APM devices by verifying your installed version via the device's web interface or CLI. If you're running an unpatched version, you're at risk. The exact affected versions are not publicly listed, so consult F5's official advisory for the full details.
Update your F5 BIG-IP APM devices to the latest patched version immediately. F5 has released fixes to address this issue. Check F5's support portal for the exact steps to apply the update and verify the fix. If you cannot update right away, monitor your devices for unusual activity, such as unexpected traffic or unauthorized command execution.
Reported details
Attackers used a known vulnerability to gain access to F5 BIG-IP APM devices. Once inside, they installed a Linux rootkit that intercepts PHP file loading and injects a fileless web shell directly into memory. This allowed them to spy on traffic, steal data, and run commands without leaving traces on disk.
A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk.