F5 BIG-IP APM Malware Hides PHP Web Shell in Memory, Evading Disk Scans

Memory-Resident Web Shell Discovered

Sophos has published an analysis detailing a new method used by malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. The malware injects a PHP web shell directly into the appliance's memory rather than writing it to a file on disk. This technique allows the web shell to operate without being detected by security tools that scan the file system for malicious scripts.

Evasion Technique

The web shell is introduced into memory when Apache loads specific PHP scripts, namely apm_css.php3, full_wt.php3, and webtop_popup_css.php3, which are part of the BIG-IP APM webtop. Because the malicious code resides only in the memory copy of these scripts, the original files on disk remain unaltered, appearing clean to defenders. This explains how F5's previous guidance, stating that changes to these scripts alone do not indicate a breach, can be true while a web shell is still present.

Link to Critical Vulnerability

The activity is linked to appliances affected by CVE-2025-53521, a vulnerability in F5 BIG-IP APM. Initially classified as a denial-of-service flaw, F5 reclassified it as a critical remote code execution vulnerability in March 2026, noting active exploitation. The flaw, which requires no authentication, has a CVSS score of 9.8 (v3.1) and 9.3 (v4.0). CISA added it to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch by March 30.

Impact and Mitigation

The vulnerability affects BIG-IP APM where an access policy is set on a virtual server, a common configuration in large organizations. Although the patch for CVE-2025-53521 has been available since October 2025, organizations that have not applied it remain vulnerable to this memory-resident web shell attack. The Sophos analysis highlights the evolving tactics of attackers and the need for advanced detection methods beyond traditional file scanning.