CERT24PoisonedRefresh fileless Linux rootkit injects a PHP web shell into F5 BIG-IP APM server memoryLoading data…
CERT24Threat Observatory
Period

PoisonedRefresh fileless Linux rootkit injects a PHP web shell into F5 BIG-IP APM server memory

SophosLabs analyzed a Linux implant named PoisonedRefresh by ESET and found in compromised F5 BIG-IP Access Policy Manager environments. F5 confirmed exploitation of the underlying CVE-2025-53521 vulnerability and linked the activity to an internal cluster tracked as c05d5254.

← Back to intelligence

PoisonedRefresh fileless Linux rootkit injects a PHP web shell into F5 BIG-IP APM server memory

SophosLabs analyzed a Linux implant named PoisonedRefresh by ESET and found in compromised F5 BIG-IP Access Policy Manager environments. F5 confirmed exploitation of the underlying CVE-2025-53521 vulnerability and linked the activity to an internal cluster tracked as c05d5254.