A web shell deployed against compromised F5 BIG-IP devices has never needed to exist as a file. It runs inside the memory of the web server process, so a scan of the web directory finds nothing.
F5 disclosed the activity as cluster c05d5254 in an advisory published March 27, 2026 and updated a week later. The advisory noted that while web shells had been seen written to disk, they had been observed to work in memory only, so the files it lists may not be modified.
ESET named the malware PoisonedRefresh in a Mastodon post on April 24, after finding two components on VirusTotal. It said a sample named umount infects the Apache binary by prepending a malicious ELF to it, and also infects files in the installation directory, which ESET assessed was likely to spread it to other systems.
Sophos analyzed the second-stage payload this week, which it detected as Linux/Agnt-IC. In an analysis published on Sept. 7, it said F5 associates the cluster with BIG-IP APM systems affected by CVE-2025-53521, which F5 describes as an exploited unauthenticated remote code execution flaw that applies where an access policy is configured on a virtual server.
For context, CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 27, the same day F5 published its advisory.
A fixed version exists, so this is post-compromise tradecraft on devices already breached rather than a live unpatched exposure. The implant runs a custom loader that gains execution before the host program’s main function, hooks Apache’s module loader to wait until PHP is present, then intercepts memory mapping inside that module.
Where Integrity Checking Still Works
The implant is not invisible on disk. F5 listed hash, size or timestamp mismatches across seven system files as indicators, among them umount, the Apache binary, chroot and rc.local.
The gap is narrower than it appears, however. Scanning the web root for a suspicious script returns nothing, because the web shell is never written there. Checking system binaries against known-good hashes is what surfaces the implant, and it is F5’s primary recommendation.
Sophos said the signals include Apache workers reading their own memory maps, memory-protection changes around the PHP module, a socket at /run/bigtlog.pipe, Apache lineage spawning /bin/bash, and PHP endpoints returning HTTP 201 with a CSS content type. F5 recorded several of the same, adding HTTP 401.
The three files targeted are apm_css.php3, full_wt.php3 and webtop_popup_css.php3, in the APM webtop renderer directory. Sophos said the targeting centers on webtop environments rather than generic Apache and PHP or common content management systems.
Neither vendor has attributed the activity. ESET said in April attribution remains undecided, while Sophos’ latest blog post said it lacks evidence to name an actor, though both call the implementation sophisticated.
