Malware associated with breaches in F5 BIG-IP Access Policy Manager appliances uses an advanced technique to hide a PHP web shell in memory, bypassing traditional file-based detection methods. Sophos, in their analysis published on September 7, revealed that the malware injects the web shell into the memory during the execution of certain PHP scripts within the Apache web server, rather than writing it to disk. This approach circumvents the usual defense mechanisms that rely on scanning files on disk for malicious activity. F5 had previously identified three specific scripts—apm_css.php3, full_wt.php3, and webtop_popup_css.php3—as part of their indicators of compromise for this malware, known as c05d5254. Despite the presence of these scripts not inherently indicating a breach, the malware's ability to operate entirely from memory makes detection challenging. The vulnerability linked to this activity, CVE-2025-53521, was initially identified as a denial-of-service issue but later reclassified as a remote code execution flaw in March 2026. This reclassification reflects its severity, with a CVSS score of 9.8, and it was added to CISA's Known Exploited Vulnerabilities catalog, mandating swift action from U.S. federal agencies. Although a patch was released in October 2025, the UK's National Cyber Security Center emphasizes the common usage of BIG-IP APM in large organizations and advises thorough investigations for potential compromise, regardless of patch status.

Sophos's report details how the malware hooks into the Apache Portable Runtime and alters the memory mappings of the PHP module, enabling the web shell to execute commands undetected. The malware's behavior includes setting up a local socket for a shell connection, further complicating detection and response strategies. However, no specific victims or attackers have been identified, and there are still unanswered questions regarding the timeline and scope of exploitation. Security teams are advised to examine behavioral indicators, along with file and memory evidence, to assess potential compromise accurately.