F5 BIG-IP APM Linux Rootkit: Detecting Fileless PHP Web Shell Injection and Defending the Edge

A reported campaign is breaching F5 BIG-IP APM environments and deploying a Linux rootkit that intercepts PHP file loading and injects a fileless web shell directly into memory. The defensive significance is high: BIG-IP APM commonly terminates SSL, brokers authentication, enforces access policies, and sits in front of critical applications. A memory-resident web shell reduces obvious disk artifacts, while a rootkit can suppress logs, hide processes, and tamper with telemetry at exactly the layer defenders trust for edge visibility.

No CVE identifier was provided in the source summary, so do not anchor response to a guessed CVE or invented CVSS score. Treat this as an active intrusion pattern against edge access infrastructure: assume attempted persistence, credential theft, session hijacking, log manipulation, and follow-on access to internal applications until proven otherwise.

What defenders should assume is at risk

BIG-IP APM is not just another Linux host. It is often the control point for remote access, federation, SSO, VPN-like access, MFA enforcement, and application delivery. If an attacker can execute code on or around the APM/PHP handling path, they may be positioned to:

• capture credentials, tokens, cookies, SAML/OIDC assertions, or session material;
• alter access-policy decisions or quietly allow unauthorized sessions;
• inject responses into application flows without writing a stable payload to disk;
• survive casual malware scans because the web shell is fileless;
• weaken trust in logs by using rootkit techniques to hide files, processes, sockets, or kernel activity;
• pivot from the edge device to internal web servers, identity systems, or management networks.

The most important mindset shift: a reboot may clear purely memory-resident shellcode, but it does not prove the environment is clean. Initial access, stolen credentials, modified configuration, implanted accounts, altered ACLs, or a persistent loader can remain. Rebuild and credential rotation are stronger than reboot-and-hope.

Technical analysis

Affected products and platforms

The source identifies F5 BIG-IP APM environments and a Linux rootkit component. BIG-IP APM runs on F5 platforms and virtual editions where the underlying operating environment is Linux-based/TMOS, with tightly controlled shell and filesystem behavior. The PHP interception detail suggests attacker interest in web handling paths where PHP code is loaded or executed, such as administrative portals, customizations, iRules-adjacent web components, plugins, companion services, or upstream PHP applications exposed through APM. Do not assume every BIG-IP deployment is exploitable; assume exposed management interfaces, weak edge hardening, delayed patching, credential reuse, and overly broad administrative access are the conditions that make this class of attack operationally useful.

Vulnerability and exploitation status

The news summary provides no CVE, affected version list, CVSS score, patch level, proof-of-concept reference, or CISA KEV confirmation. It does describe hackers breaching devices and deploying a rootkit, which should be treated as confirmed active intrusion behavior rather than a theoretical weakness. The attack chain described is: gain access to the target environment, deploy a Linux rootkit, hook or intercept PHP file loading, then inject a fileless web shell into memory so that subsequent requests execute attacker logic without leaving a conventional web shell file.

From a defender perspective, the critical mechanics are the behaviors rather than a single indicator:

• interception of PHP file loading implies tampering with loader precedence, interpreter configuration, process memory, preload mechanisms, modules/extensions, or runtime state;
• fileless injection implies use of process memory, anonymous executable mappings, memfd-like artifacts, injected threads, or runtime patching rather than dropped PHP files;
• rootkit deployment implies attempts to control visibility: hiding processes, sockets, files, log entries, or kernel/module state;
• edge-device targeting implies theft or manipulation of authentication and session material should be in scope for IR.

Practical attack-chain model for hunting

Use this sequence to scope detection and response:

1. Initial access to the appliance, management plane, adjacent admin host, or application path reachable by APM.
2. Execution of privileged commands or loading of a persistence/hiding component consistent with a Linux rootkit.
3. Modification of runtime loading behavior so PHP requests are intercepted. Candidate telemetry includes preload files, environment variables, changed PHP configuration, suspicious shared-object loads, unexpected child processes under web/PHP workers, or anomalous executable memory mappings.
4. Memory-only command and control through a web shell. Candidate telemetry includes web/PHP processes making rare outbound connections, unusual request bodies, encoded POSTs to rarely used URIs, and worker processes executing commands they normally never run.
5. Defense evasion: log deletion, timestomping, hidden processes/sockets, suppressed syslog forwarding, or new local accounts and SSH keys.

The absence of a dropped PHP file is not evidence of absence. Hunt the runtime and the control plane.

Detection and response

The detections below are intentionally behavior-focused and should be tuned before broad deployment. On BIG-IP/TMOS, prefer F5-supported diagnostics, configuration backups, external syslog, and vendor guidance. Use endpoint rules on Linux admin hosts, PHP application servers behind APM, jump boxes, and any Linux system in the trust path. Do not install unapproved tooling on production F5 appliances.

---
title: Linux Loader Preload Tampering Consistent With Rootkit or PHP Interception
id: 6b4c9f70-2a7d-4f2b-9b6a-8d1f7a25c901
status: experimental
description: Detects modification or creation of dynamic loader preload artifacts and preload environment usage that can be used to intercept program/library loading on Linux systems supporting APM, PHP, or edge-management paths.
references:
  - https://attack.mitre.org/techniques/T1574/006/
  - https://attack.mitre.org/techniques/T1014/
author: Security Arsenal
date: 2026/07/03
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1574.006
  - attack.t1014
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|endswith:
      - '/etc/ld.so.preload'
      - '/ld.so.preload'
  selection_env:
    CommandLine|contains:
      - 'LD_PRELOAD='
      - '/etc/ld.so.preload'
  condition: selection_paths or selection_env
falsepositives:
  - Legitimate performance, debugging, security-agent, or vendor preload changes during approved maintenance windows
level: high
---
title: Web or PHP Worker Spawning Unexpected Shell or Network Tool
id: 0d2f5d9b-8a06-4e3d-b6a1-2e7c5f41a9d2
status: experimental
description: Detects PHP, HTTP, proxy, or APM-adjacent worker processes launching shells, interpreters, or download tools that are inconsistent with normal request handling and may indicate an in-memory web shell executing commands.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/07/03
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parents:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php'
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/lighttpd'
      - '/haproxy'
  selection_children:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/openssl'
  condition: selection_parents and selection_children
falsepositives:
  - Rare application plugins, health checks, backup jobs, or administrative automation executed under web service accounts
level: high
---
title: Suspicious Outbound Connection From PHP or Web Worker Process
id: 4f7aa1c8-55c9-4c44-9d2b-0b9b7d2f18d3
status: experimental
description: Detects web/PHP worker processes initiating outbound connections to uncommon external destinations, a possible indicator of a fileless web shell or injected handler communicating after PHP loading interception.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/07/03
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php-fpm'
      - '/php'
      - '/httpd'
      - '/apache2'
      - '/nginx'
    Initiated: 'true'
  filter_private:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection and not filter_private
falsepositives:
  - Legitimate outbound API calls, license checks, update services, or identity-provider integrations from application tiers
level: medium

// Sentinel/Defender hunt: preload tampering, suspicious web-worker children, and rare outbound connections
let lookback = 14d;
union isfuzzy=true
  (Syslog
   | where TimeGenerated > ago(lookback)
   | where SyslogMessage has_any ("ld.so.preload", "LD_PRELOAD", "php-fpm", "apache", "httpd", "nginx", "big-ip", "apm")
   | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage, Facility, SeverityLevel),
  (CommonSecurityLog
   | where TimeGenerated > ago(lookback)
   | where Message has_any ("ld.so.preload", "LD_PRELOAD", "php-fpm", "httpd", "nginx", "F5", "BIG-IP", "APM")
   | project TimeGenerated, DeviceName, SourceIP, DestinationIP, DeviceProcessName, Message),
  (DeviceProcessEvents
   | where TimeGenerated > ago(lookback)
   | where InitiatingProcessFileName in~ ("php-fpm", "php", "httpd", "apache2", "nginx", "haproxy")
      and FileName in~ ("bash", "sh", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat", "openssl")
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName),
  (DeviceNetworkEvents
   | where TimeGenerated > ago(lookback)
   | where InitiatingProcessFileName in~ ("php-fpm", "php", "httpd", "apache2", "nginx")
   | extend RemoteIPType = iff(ipv4_is_private(RemoteIP), "private", "public")
   | where RemoteIPType == "public"
   | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Ports=make_set(RemotePort), Actions=make_set(ActionType) by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
   | order by Connections desc)

-- Linux hunt artifact for systems in the APM/PHP trust path; do not treat as a substitute for F5-supported appliance diagnostics.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       netstat() AS Connections
FROM pslist()
WHERE CommandLine =~ '(LD_PRELOAD|ld\.so\.preload|base64|curl|wget|ncat|socat)'
   OR Name =~ '^(php-fpm|php|httpd|apache2|nginx|haproxy)$'
   OR Exe =~ '(deleted|memfd|/dev/shm|/tmp|/var/tmp)'

-- Separate artifact: preload and suspicious writable-path execution artifacts
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/etc/ld.so.preload', '/etc/ld.so.conf.d/*', '/tmp/*', '/var/tmp/*', '/dev/shm/*'])
WHERE FullPath =~ '(ld\.so\.preload|ld\.so\.conf|\.so$)'
   OR Mode =~ 'x'

#!/usr/bin/env bash
# Defensive triage for Linux admin/PHP systems in an F5 BIG-IP APM trust path.
# Run read-only checks first. Use F5-supported commands/support for BIG-IP/TMOS appliances.
set -euo pipefail
OUT="/tmp/f5_apm_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"
chmod 700 "$OUT"
{
  echo "== identity =="; hostname; date -u; id
  echo "== os =="; uname -a; cat /etc/os-release 2>/dev/null || true
  echo "== loader preload =="
  ls -l /etc/ld.so.preload /etc/ld.so.conf.d/ 2>/dev/null || true
  [ -f /etc/ld.so.preload ] && cat /etc/ld.so.preload || echo "no /etc/ld.so.preload"
  echo "== suspicious env =="
  grep -R "LD_PRELOAD" /etc/environment /etc/profile /etc/profile.d /etc/php* /etc/httpd /etc/apache2 /etc/nginx 2>/dev/null || true
  echo "== web/php process tree =="
  ps -eo pid,ppid,user,comm,args --forest | egrep -i 'php-fpm|php|httpd|apache2|nginx|haproxy|big-ip|apm' || true
  echo "== suspicious children of web/php =="
  ps -eo pid,ppid,user,comm,args | egrep -i 'php-fpm|php|httpd|apache2|nginx|haproxy' | egrep -i 'bash|sh|dash|python|perl|curl|wget|nc|ncat|socat|openssl' || true
  echo "== deleted/memfd/tmp executables =="
  for p in /proc/[0-9]*; do
    exe=$(readlink "$p/exe" 2>/dev/null || true)
    case "$exe" in *deleted*|*memfd*|/dev/shm/*|/tmp/*|/var/tmp/*) echo "$p exe=$exe cmd=$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null)";; esac
  done
  echo "== outbound sockets from web/php =="
  ss -tanp 2>/dev/null | egrep -i 'php-fpm|php|httpd|apache2|nginx|haproxy' || true
  echo "== recent php/web config changes =="
  find /etc /usr/local/etc /opt -xdev \( -iname '*php*' -o -iname '*httpd*' -o -iname '*apache*' -o -iname '*nginx*' \) -mtime -14 -ls 2>/dev/null | head -200 || true
  echo "== auth and account anomalies =="
  getent passwd | awk -F: '$3==0 {print}'
  ls -la /root/.ssh /home/*/.ssh 2>/dev/null || true
  tail -n 200 /var/log/auth.log 2>/dev/null || tail -n 200 /var/log/secure 2>/dev/null || true
} > "$OUT/triage.txt" 2>&1
echo "Wrote $OUT/triage.txt"
echo "Next: capture volatile memory with an approved IR method, compare against known-good config, preserve external syslog, and engage F5 support before making changes on BIG-IP/TMOS."

Response actions

If any of these behaviors are confirmed in an APM environment, escalate to incident response rather than treating it as routine malware cleanup.

1. Isolate carefully. Remove the device or affected VIP/context from production according to change control, but preserve evidence first. For edge devices, coordinate isolation with application owners because APM may control access to many downstream systems.
2. Capture volatile evidence before reboot. Collect process lists, socket tables, routing/ARP, logged-in users, running services, kernel/module state where supported, syslog forwarding status, configuration differences, authentication logs, admin session history, and external log copies. A memory-only web shell may disappear on reboot; your best evidence may be in memory, network captures, load-balancer logs, identity-provider logs, and downstream application logs.
3. Verify management-plane exposure. Confirm whether the management interface, self IPs, iControl REST, SSH, SNMP, or administrative portals were reachable from untrusted networks. Restrict management to a dedicated out-of-band network, enforce MFA and role-based access, disable unused services, and require jump-host access with session recording.
4. Diff configuration against a known-good backup. Review access profiles, per-request policies, ACLs, iRules, virtual servers, pools, profiles, certificates/keys, local users, remote auth settings, syslog destinations, NTP/DNS, routes, and SNMP communities. Assume silent configuration persistence is possible even if the web shell was fileless.
5. Rotate secrets in dependency order. Prioritize appliance admin credentials, SSH keys, API tokens, iControl credentials, SNMP secrets, service accounts, LDAP/AD bind accounts, SAML/OIDC client secrets, certificates/private keys, session-signing material where applicable, and any credentials that transited APM during the exposure window. Do not rotate into a potentially compromised device; rotate after isolation, rebuild, or vendor-guided recovery.
6. Rebuild rather than clean when rootkit activity is credible. Rootkits undermine confidence in the operating system's ability to report truth. Use vendor-supported re-imaging/redeployment, restore from a configuration known to predate compromise, reissue certificates/keys, and validate binaries/config through F5-supported integrity processes.
7. Patch and version-align through official F5 channels. Because no CVE or fixed version was provided in the source summary, do not claim a specific hotfix. Consult F5 Security Advisories, BIG-IP APM release notes, iHealth diagnostics, and F5 Support for the exact supported path for your platform and software branch. Track whether CISA KEV or F5 later attributes a specific CVE and update change windows accordingly.
8. Hunt identity and application telemetry. Review IdP, MFA, AD/LDAP, EDR, WAF, application, database, VPN, and internal proxy logs for impossible travel, new token issuance, MFA fatigue, session reuse after password reset, service-account anomalies, and access from the appliance or adjacent admin hosts.
9. Preserve external logging. Ensure BIG-IP, PHP/application servers, IdP, firewall, and EDR logs are forwarded off-box with immutable retention. If local logs conflict with external logs, treat local telemetry as suspect.
10. Validate recovery. Before return to production, verify no preload tampering, no unexpected web-worker child processes, no unexplained outbound connections, clean configuration diff, correct syslog forwarding, rotated secrets, closed management exposure, and vendor support concurrence.

Remediation priorities

• Immediately: restrict management-plane reachability; enable/verify external logging; snapshot or preserve evidence; block newly observed egress from web/PHP workers; alert on loader-preload changes.
• Within 24 hours for suspected compromise: open an IR case, contact F5 Support, inventory APM versions/branches, diff configs, rotate high-risk secrets after containment, and hunt downstream identity/application systems.
• Before reopening access: rebuild or restore from known-good, reissue credentials/certificates, confirm monitoring detects the behaviors above, and document the initial access vector. If the initial access vector is unknown, recurrence risk remains high.
• Long term: enforce signed/config-backed change control for APM objects, alert on configuration export/import, separate admin networks, reduce local accounts, require phishing-resistant MFA for administrators, monitor edge devices as Tier-0 assets, and rehearse edge-device compromise in tabletop and purple-team exercises.

Defensive lesson

The important lesson is not a single indicator or a guessed CVE. It is that edge access platforms concentrate trust, credentials, sessions, and network position. When attackers pair edge compromise with rootkit behavior and memory-only execution, disk-centric antivirus and simple file-hash hunting will miss the intrusion. Detection must combine control-plane integrity, loader/runtime telemetry, process lineage, egress monitoring, external logging, and rapid credential/config response. Treat BIG-IP APM as critical identity-adjacent infrastructure, not a passive network box.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub