PoisonedRefresh Rootkit Exploiting CVE-2025-53521 on BIG-IP APM

Analysis of cluster c05d5254 reveals a sophisticated Linux rootkit named PoisonedRefresh (also detected as Linux/Agnt-IC) targeting F5 BIG-IP APM appliances. The attack leverages CVE-2025-53521, an unauthenticated remote code execution vulnerability in the access policy daemon (apmd). While initially classified as a denial-of-service risk in late 2025, it was reclassified as RCE in March 2026, creating a critical exposure window for organizations that did not prioritize patching.

The malware employs a highly specialized two-stage infection chain. An installer modifies the Apache binary and injects malicious code into BIG-IP upgrade images to ensure persistence across device updates. The second-stage rootkit operates entirely in memory, hooking Apache's runtime and the PHP module to serve a fileless web shell. By intercepting memory-mapping calls (mmap), the rootkit presents a malicious version of legitimate PHP scripts (e.g., apm_css.php3) to the execution engine while leaving the on-disk files untouched.

This threat is significant due to its 'Nobody But Us' (NOBUS) design, using per-sample RC4 keys for command-and-control (C2) and a hidden UNIX domain socket for shell access. Because the rootkit persists through system upgrades and leaves no disk-based artifacts for the web shell, traditional file integrity monitoring is ineffective. Affected organizations should assume compromise if patching was delayed and conduct memory-level forensic investigations.