[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb0Cku8S_vByJvzKV4WvnlcNgdd9157PDTx-MO5lzjq0":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":171},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4415c577-c90d-4964-a301-abd65aee43f5","Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit","hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit-11f562","A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]","A new Linux rootkit, identified as 'PoisonedRefresh', is targeting F5 BIG-IP APM devices by exploiting CVE-2025-53521. The malware injects a fileless web shell directly into memory, bypassing disk-based detection. It achieves persistence by infecting the Apache httpd executable and modifying SELinux configurations.","Hackers deploy Linux rootkit on F5 BIG-IP APM devices via RCE vulnerability.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F10\u002F15\u002FF5_01.png","2026-09-08T20:08:55+00:00","2026-09-08T22:00:24.719569+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"BIG-IP APM","product",{"name":21,"type":22},"F5 Networks","vendor",{"name":24,"type":25},"Linux rootkit","technology",{"name":27,"type":25},"web shell",{"name":29,"type":25},"PHP",{"name":31,"type":25},"Apache","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2025-53521","Exploited RCE vulnerability used for initial access",{"type":36,"value":61,"context":62},"PoisonedRefresh","Name given by ESET to the rootkit",[21,18],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":125,"name":126,"problem":127,"products":128},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[154,160,166],{"slug":155,"name":156,"logo_path":157,"roles":158},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[159],"reported_by",{"slug":161,"name":162,"logo_path":163,"roles":164},"f5","F5","\u002Fvendor-logos\u002Ff5.png",[165],"affected",{"slug":167,"name":168,"logo_path":169,"roles":170},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[159],{"slug":172,"title":173,"body":174,"framework_refs":175,"framework_notes":188},"linux-rootkit-exploits-unpatched-f5-big-ip-apm-flaw-to-achieve-fileless-persistence","Linux Rootkit Exploits Unpatched F5 BIG-IP APM Flaw to Achieve Fileless Persistence","The PoisonedRefresh rootkit exploits CVE-2025-53521, a critical vulnerability in F5 BIG-IP APM devices that had not been patched on affected systems. By injecting a fileless web shell directly into memory and infecting the Apache httpd binary, attackers evade traditional disk-based detection tools entirely. The malware further entrenches itself by tampering with SELinux configurations — a mandatory access control mechanism — effectively disabling a key defensive layer. This attack illustrates how unpatched network appliances, especially those exposed to the internet, represent high-value entry points that can be compromised with devastating stealth. Organizations that rely solely on file-based antivirus or lack memory-level inspection are particularly blind to this class of threat.",[176,177,178,179,180,181,182,183,184,185,186,187],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST CM-6: Configuration Settings","NIST RA-5: Vulnerability Monitoring and Scanning","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1562.001: Disable or Modify Security Tools",{}]