- The Mess: Attackers compromised F5 BIG-IP systems and deployed a PHP web-server rootkit that hides its backdoor inside process memory instead of leaving a conventional shell on disk.
- The Damage: File scanning can come back clean while the compromised web server continues executing attacker-controlled code.
- The Fix: Patch exposed BIG-IP systems, investigate for process-level compromise and rebuild affected appliances rather than trusting a clean filesystem.
The web shell isn’t missing.
You’re just looking in the wrong place.
Sophos researchers dissected a previously undocumented rootkit targeting PHP-based web servers on compromised F5 BIG-IP APM systems. Instead of dropping a familiar PHP backdoor into the web root, the implant operates inside the memory of the running server process.
No suspicious .php file.
No obvious backdoor sitting in the document root.
And potentially nothing useful for a traditional file-based scanner to find.
The Backdoor Lives Where Your Scanner Doesn’t
The implant uses runtime manipulation to interfere with the PHP web-server process itself.
Rather than modifying the application’s source files, the malware loads into memory and hooks execution inside the running process. The result is a backdoor that can process attacker-controlled requests without requiring a persistent PHP shell to remain on disk.
That changes the investigation.
A normal web-shell hunt often starts with the filesystem:
- recently modified PHP files,
- strange filenames,
- encoded payloads,
- writable upload directories,
- modified web roots.
This implant makes that workflow incomplete.
The filesystem can look perfectly normal while the process serving requests has already been modified.
A Web Shell Without a Web-Shell File
The rootkit abuses low-level ELF loading and runtime patching techniques to inject functionality into the web-server process.
Sophos describes the malware as manipulating the execution environment so that attacker-controlled requests can reach malicious functionality embedded in memory.
That gives the attacker a useful advantage.
The malicious logic runs inside a legitimate process.
To a basic monitoring system, the server may simply look like it is doing what it always does:
serving web requests.
Except now some requests have a second meaning.
Why BIG-IP Makes This Worse
F5 BIG-IP appliances often sit in places attackers care about.
They can handle:
- remote access,
- authentication,
- application delivery,
- traffic management,
- VPN services,
- enterprise access infrastructure.
Compromising one isn’t the same as compromising a random web server.
It can put an attacker directly inside infrastructure that sees authentication flows and enterprise traffic.
The Sophos investigation connects the affected environments with exploitation activity involving F5 BIG-IP APM vulnerabilities, including previously exploited flaws that attackers used to gain an initial foothold.
And once an attacker reaches the appliance, persistence becomes the next problem.
That’s where the fileless rootkit matters.
“No Malicious Files Found” Isn’t an Answer
This is the dangerous operational lesson.
A compromised appliance can pass a simplistic file-based investigation.
Security teams may search for:
*.php
*.jsp
*.aspx
webshell
cmd
base64
eval(
And find nothing.
That does not mean the system is clean.
If malicious functionality was injected into the process memory, the filesystem isn’t the source of truth anymore.
The process is.
Investigators need to look at:
- unexpected process memory mappings,
- anomalous loaded libraries,
- modified runtime code,
- suspicious network connections from server processes,
- unexpected child processes,
- unexplained hooks or altered execution paths.
Patch First. Then Assume the Appliance Is Dirty.
Patching removes the initial vulnerability.
It does not necessarily remove the attacker.
That’s the mistake organizations keep making after edge-device exploitation.
The patch closes the door.
But it doesn’t tell you who already walked through it.
F5 has issued security guidance for affected BIG-IP vulnerabilities, while incident-response reporting has repeatedly shown attackers moving quickly from initial access to persistence on exposed infrastructure.
If there are signs that a BIG-IP system was compromised, treating it as a simple patching incident is risky.
The appliance should be investigated as a potentially persistent compromise.
Bugstoday Opinion
This is where security advice gets dangerously comfortable.
“We scanned the appliance and didn’t find a web shell.”
Great.
The web shell wasn’t on the appliance’s filesystem.
Attackers are getting better at moving persistence into places defenders don’t routinely inspect. A backdoor inside process memory doesn’t need a clever filename, encryption or obfuscation if the investigation never looks at memory in the first place.
And edge devices remain perfect targets.
They are exposed.
They are trusted.
They often sit between users and everything else.
A clean disk is not the same thing as a clean server.
Especially when the attacker decided to leave the backdoor running instead of saving it.
The filesystem can be clean. The process can still be owned.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Sophos X-Ops — technical analysis of the PHP web-server rootkit
- F5 Security Advisory — BIG-IP APM vulnerability and remediation guidance
- Public technical reporting on exploitation and persistence affecting BIG-IP infrastructure
