Sophos published an analysis on September 7, 2026 detailing a malware strain recovered from compromised F5 BIG-IP Access Policy Manager (APM) appliances that takes an unusual and dangerous approach to persistence: it never writes its web shell to disk. Instead, the malware hooks the Apache worker process on the appliance and injects a PHP web shell into the in-memory copy of three of the appliance's own legitimate PHP scripts every time Apache loads them. The file on disk remains byte-for-byte identical to the F5-shipped original — meaning integrity checks, AV scans, and file-hash comparisons all come back clean while the attacker retains full remote code execution on the edge device.
This is a meaningful escalation in edge-device tradecraft. BIG-IP APM sits at the perimeter brokering authentication, VPN, and SSO sessions. An attacker with a memory-resident shell on that tier has visibility into credentials in transit, session tokens, and the internal network behind the access gateway. If you operate BIG-IP APM appliances — particularly any that have been exposed to the internet with management or self-IP interfaces reachable — you need to assume file-based verification is insufficient and hunt for the runtime behavior instead.
Technical Analysis
Affected Platform
- Product: F5 BIG-IP Access Policy Manager (APM), running on Apache with the appliance's native PHP codebase
- Attack surface: Internet-facing BIG-IP APM virtual servers and any reachable management interfaces
- Malware behavior: Runtime code injection into Apache's in-memory representation of legitimate appliance PHP scripts
How the Technique Works
The attack chain, as described by Sophos, works as follows:
- Initial compromise of the BIG-IP APM appliance occurs through a break-in (the delivery vector is tied to intrusions against these appliances; operators of internet-exposed APM instances should review their exposure against F5's published advisories for recently patched edge vulnerabilities).
- The malware installs a hook such that whenever Apache loads any of three specific BIG-IP APM PHP scripts, the web shell code is appended or merged into the copy held in the Apache worker's memory.
- The on-disk PHP files are never modified. Any
md5sumcomparison against known-good F5 hashes, Tripwire-style file integrity monitoring, or signature-based AV scanning of the filesystem returns a negative result. - The attacker accesses the shell through HTTP requests to the legitimate, expected script URIs — meaning network traffic to the shell is indistinguishable by URL alone from normal appliance traffic. The discriminator is in request parameters, timing, source addresses, and process behavior.
From a defender's perspective, the critical implications are:
- File integrity monitoring (FIM) is blind. The malicious logic exists only in process memory.
- The web shell rides legitimate URIs. You cannot blocklist the script paths — they are required for APM to function.
- Restarting Apache clears the shell from memory but not the injection hook. If the persistence mechanism that performs the injection survives the restart, the shell returns as soon as the scripts are next loaded. Eradication requires finding and removing the injector component, not just bouncing the service.
- Credential exposure is the primary risk. APM terminates authentication flows. Assume any appliance confirmed to have run this malware has exposed session credentials and treat accordingly.
Exploitation Status
Sophos attributes the malware to confirmed, active break-ins against BIG-IP APM appliances — this is not a theoretical proof of concept. The technique is operational in the wild. No CVE identifier was published in the reporting for the injection mechanism itself, and defenders should monitor F5's security advisory feed and CISA's Known Exploited Vulnerabilities catalog for any associated CVE designation as the investigation matures.
Detection & Response
Because the shell never touches disk, detection has to pivot to three observable surfaces: process behavior (Apache workers executing shell commands or making unexpected connections), network behavior (anomalous requests to the legitimate APM PHP endpoints), and persistence artifacts (the injector that re-arm's Apache's memory has to live somewhere — a modified config, an injected shared object, a cron entry, or a tampered startup script).
Sigma Rules
---
title: F5 BIG-IP Apache Worker Spawning Shell or Command Interpreter
id: 3f9c1b84-2a6d-4e57-b8f1-9c4d5e6a7b02
status: experimental
description: Detects Apache httpd worker processes on F5 BIG-IP appliances spawning shells or command interpreters, consistent with a memory-resident PHP web shell executing attacker commands. Legitimate APM operation does not require httpd to spawn interactive shells or system utilities.
references:
- https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html
- https://attack.mitre.org/techniques/T1059/004/
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/09
tags:
- attack.persistence
- attack.execution
- attack.t1505.003
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/httpd'
- '/apache2'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/perl'
- '/nc'
- '/ncat'
- '/socat'
- '/chmod'
- '/chown'
- '/base64'
condition: selection_parent and selection_child
falsepositives:
- Rare F5 iCall or monitor scripts that shell out from web context - validate against F5 support documentation before whitelisting
level: high
---
title: F5 BIG-IP httpd Unexpected Outbound Network Connection
id: 8b2e4f16-7c3a-4d91-a5e8-1f6b7c8d9e03
status: experimental
description: Detects Apache httpd on BIG-IP appliances initiating outbound connections to external hosts. A web shell executing attacker commands frequently beacons out, pulls second-stage tooling, or exfiltrates harvested credentials. Baseline httpd egress is minimal on a healthy appliance.
references:
- https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html
- https://attack.mitre.org/techniques/T1071/001/
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/09
tags:
- attack.command_and_control
- attack.exfiltration
- attack.t1071.001
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith: '/httpd'
Initiated: 'true'
filter_internal:
DestinationIp|startswith:
- '10.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.2'
- '172.30.'
- '172.31.'
- '192.168.'
- '127.'
condition: selection and not filter_internal
falsepositives:
- Licensed outbound calls to F5 licensing/telemetry endpoints - whitelist destination FQDNs documented by F5
level: high
---
title: Suspicious POST or Parameter-Anomaly Against BIG-IP APM PHP Endpoints
id: c51d7a29-4e8b-4f36-9d2a-6b3c1e5f7a04
status: experimental
description: Detects HTTP requests to BIG-IP APM PHP scripts carrying parameters commonly used by PHP web shells (cmd, exec, shell, passthru, base64-encoded payloads) or from user agents inconsistent with normal APM client traffic. The memory-resident shell rides legitimate script URIs, so request content is the primary network discriminator.
references:
- https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/09
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
product: linux
detection:
selection_uri:
cs-uri|endswith: '.php'
selection_param:
cs-uri-query|contains:
- 'cmd='
- 'exec='
- 'shell='
- 'passthru'
- 'system('
- 'base64_decode'
- 'eval('
- 'assert('
condition: selection_uri and selection_param
falsepositives:
- Vulnerability scanners and authorized penetration tests - correlate with sanctioned testing windows
level: high
Microsoft Sentinel / Defender KQL
This query hunts BIG-IP syslog and WAF/access logs ingested into Sentinel (via CEF/Syslog connectors from the appliance or an upstream load balancer/WAF) for web-shell-style request parameters against PHP endpoints, plus anomalous process execution reported by any Linux endpoint telemetry covering the appliance.
// Hunt 1: Web shell parameter patterns against BIG-IP APM PHP endpoints (via Syslog/CEF ingestion)
let shellParams = dynamic(["cmd=", "exec=", "shell=", "passthru", "system(", "base64_decode", "eval(", "assert("]);
union isfuzzy=true Syslog, CommonSecurityLog
| where TimeGenerated > ago(14d)
| where Message contains ".php" or AdditionalExtensions contains ".php"
| extend RequestLine = coalesce(extract(@"(GET|POST|HEAD) [^ ]*\.php[^ ]*", 0, Message), AdditionalExtensions)
| where RequestLine has_any (shellParams)
| extend SourceIP = coalesce(SourceIP, extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 0, Message))
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), RequestCount = count(), DistinctURIs = dcount(RequestLine) by SourceIP, Computer
| where RequestCount > 3
| sort by RequestCount desc;
// Hunt 2: httpd spawning command interpreters (Linux auditd/Sysmon-for-Linux telemetry via SecurityEvent or Syslog)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has "httpd"
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "base64 -d", "nc -")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;
// Hunt 3: Rare external destinations contacted by BIG-IP appliance (CEF flow/firewall data)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceProduct has_any ("BIG-IP", "F5")
| where DeviceAction == "allowed" or isnull(DeviceAction)
| where not(DestinationIP startswith "10." or DestinationIP startswith "192.168." or DestinationIP startswith "172.")
| summarize ConnCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DestinationIP, DestinationPort, SourceIP
| where ConnCount < 50 // low-and-slow beaconing
| sort by ConnCount asc;
Velociraptor VQL
Use this artifact during live response on a captured image or against a Linux endpoint with a Velociraptor-compatible collection to enumerate httpd worker processes with suspicious children, unexpected listeners, and PHP files whose mtime clusters around a suspected compromise window (the on-disk files are clean, but the injector and any dropped tooling still have filesystem footprints).
-- F5 BIG-IP APM memory-web-shell triage: httpd process tree, listeners, and recent filesystem changes
-- Process tree: httpd parents with non-httpd children are the smoking gun
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
SELECT Pid FROM pslist() WHERE Name =~ 'httpd'
)
AND NOT Name =~ 'httpd'
-- Listeners: identify unexpected listening sockets owned by httpd or unknown processes
SELECT Pid, Name, Family, Type, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
OR (Name =~ 'httpd' AND RemotePort > 0)
ORDER BY LocalPort
-- Recently modified files in web and config trees (injector staging artifacts)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/**/*.php', '/etc/httpd/**/*', '/config/**/*', '/etc/cron.d/*', '/etc/rc*.d/*'])
WHERE Mtime > (now() - (30 * 24 * 3600))
ORDER BY Mtime DESC
Triage and Hardening Script
Run this on the BIG-IP appliance via an advanced shell (bash) session during the response. It validates on-disk integrity (expected clean — do not stop there), enumerates httpd behavior, snapshots persistence surfaces, and captures memory evidence before any service restart destroys it.
#!/bin/bash
# BIG-IP APM memory-resident web shell triage - run BEFORE restarting httpd
EVIDENCE_DIR=/var/tmp/ir_triage_$(date +%Y%m%d_%H%M%S)
mkdir -p "$EVIDENCE_DIR" && chmod 700 "$EVIDENCE_DIR"
# 1) Capture httpd process tree and full command lines (shell spawns visible here)
ps auxfww > "$EVIDENCE_DIR/ps_tree.txt"
pgrep -a -P "$(pgrep -o httpd)" >> "$EVIDENCE_DIR/httpd_children.txt" 2>/dev/null
# 2) Capture socket state - look for httpd with unexpected established outbound connections
netstat -antp > "$EVIDENCE_DIR/netstat.txt"
ss -antp >> "$EVIDENCE_DIR/netstat.txt"
# 3) Snapshot persistence surfaces the injector may live in
crontab -l > "$EVIDENCE_DIR/crontab_root.txt" 2>/dev/null
ls -laR /etc/cron.d /etc/cron.daily /etc/cron.hourly > "$EVIDENCE_DIR/cron_dirs.txt" 2>/dev/null
cp -a /etc/httpd/conf "$EVIDENCE_DIR/httpd_conf" 2>/dev/null
httpd -M > "$EVIDENCE_DIR/apache_modules.txt" 2>/dev/null # unexpected/unsigned modules = injection vector
ldd "$(command -v httpd)" > "$EVIDENCE_DIR/httpd_linked_libs.txt" 2>/dev/null
# 4) Diff loaded modules and LD_PRELOAD-style tampering (common memory-injection hook)
cat /etc/ld.so.preload > "$EVIDENCE_DIR/ld_preload.txt" 2>/dev/null
env | grep -i ld_ >> "$EVIDENCE_DIR/ld_preload.txt"
# 5) Hash the three APM PHP scripts and ALL PHP in the web root - compare against known-good F5 build hashes
find /var/www -name '*.php' -exec md5sum {} \; > "$EVIDENCE_DIR/php_hashes.txt" 2>/dev/null
# 6) Capture memory of one httpd worker for forensic analysis BEFORE restart
WORKER_PID=$(pgrep httpd | head -1)
if [ -n "$WORKER_PID" ]; then
gcore -o "$EVIDENCE_DIR/httpd_core" "$WORKER_PID" 2>/dev/null || \
dd if=/proc/"$WORKER_PID"/mem of="$EVIDENCE_DIR/httpd_mem.bin" bs=1M 2>/dev/null
fi
# 7) Pull recent web access log entries for PHP requests with suspicious parameters
grep -Eh '\.php' /var/log/httpd/access_log* 2>/dev/null | \
grep -Ei 'cmd=|exec=|shell=|passthru|base64_decode|eval\(|assert\(' > "$EVIDENCE_DIR/suspicious_php_requests.txt"
# 8) Only AFTER evidence capture: restart httpd to flush the in-memory shell, then watch for re-injection
echo "Evidence captured in $EVIDENCE_DIR - review httpd_children.txt and apache_modules.txt before restarting"
# bigstart restart httpd # uncomment only after forensic capture is verified
Remediation
- Isolate before you remediate. Remove the suspect appliance from the load-balanced pool and restrict all inbound access at the perimeter firewall. Do not reboot or restart httpd until memory evidence is captured — the shell is volatile and a restart destroys attribution-quality data.
- Assume credential compromise. APM terminates authentication. Force password resets and revoke active sessions/OAuth tokens for every identity that transited the appliance during the suspected exposure window. Rotate any service accounts, certificates, and API keys stored on or referenced by the device.
- Verify build and patch level against F5 advisories. Check the appliance against F5's published security advisories at MyF5 Security Advisories and apply all outstanding hotfixes for your BIG-IP branch. If the appliance was running an end-of-software-support version, plan an immediate upgrade to a supported release — unsupported branches receive no security fixes.
- Find the injector, not just the shell. Restarting Apache clears the memory-resident shell, but the component performing the injection (tampered module, preload library, config hook, or cron-based re-arm) will restore it on next script load. If you cannot identify and remove the injector with high confidence, reimage the appliance from known-good F5 media and restore configuration from a backup that predates the suspected compromise. This is the only fully reliable eradication path for memory-resident persistence on an edge device.
- Harden the management plane. Confirm the Configuration Utility (TMUI) and iControl REST are not reachable from the internet or from user VLANs. Restrict management access to a dedicated out-of-band network, enforce MFA for administrative logon, and disable SSH root access.
- Deploy behavioral detection going forward. File integrity monitoring alone cannot catch this class of implant. Forward BIG-IP syslog and Apache access logs to your SIEM, enable process accounting or auditd where the platform permits, and alert on any httpd child process that is not httpd itself.
- Hunt retrospectively. Use the KQL queries above against 14–30 days of retained logs to identify anomalous PHP requests and low-and-slow outbound connections. Treat any hit as a confirmed-compromise indicator and scope for lateral movement from the appliance into internal authentication infrastructure.
- Report and coordinate. Engage F5 Support and reference the Sophos analysis. If you confirm compromise, report to CISA (if applicable to your sector) and preserve forensic images for attribution.
Edge devices are now the primary initial-access battleground, and memory-resident implants like this one are purpose-built to defeat the verification methods most teams rely on. The defensive posture has to shift from "is the file clean" to "is the process behaving correctly" — for BIG-IP, that means process telemetry, egress monitoring, and a low threshold for reimaging.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.