[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fryzuVd-fv6tqImBpOY0FjV6utXBLGA81xTZYs1jp3z4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"c91d8269-1688-4250-8018-18931bfb053e","linux-rootkit-exploits-unpatched-f5-big-ip-apm-flaw-to-achieve-fileless-persistence","4415c577-c90d-4964-a301-abd65aee43f5","Linux Rootkit Exploits Unpatched F5 BIG-IP APM Flaw to Achieve Fileless Persistence","The PoisonedRefresh rootkit exploits CVE-2025-53521, a critical vulnerability in F5 BIG-IP APM devices that had not been patched on affected systems. By injecting a fileless web shell directly into memory and infecting the Apache httpd binary, attackers evade traditional disk-based detection tools entirely. The malware further entrenches itself by tampering with SELinux configurations — a mandatory access control mechanism — effectively disabling a key defensive layer. This attack illustrates how unpatched network appliances, especially those exposed to the internet, represent high-value entry points that can be compromised with devastating stealth. Organizations that rely solely on file-based antivirus or lack memory-level inspection are particularly blind to this class of threat.","**Immediate Actions:**\n- Apply F5's official patch or mitigation for CVE-2025-53521 immediately across all BIG-IP APM instances.\n- Audit and restore SELinux configurations to enforcing mode on all affected and potentially exposed devices.\n- Isolate internet-facing F5 BIG-IP appliances behind strict firewall rules until patching is confirmed complete.\n\n**Detection Measures:**\n- Deploy runtime memory integrity monitoring and behavioral analysis tools capable of detecting fileless malware and in-memory web shells.\n- Monitor for unexpected modifications to critical binaries such as Apache httpd using file integrity monitoring (FIM) tools.\n- Centralize and alert on SELinux policy change events within your SIEM to catch unauthorized configuration tampering.\n\n**Long-Term Improvements:**\n- Maintain a continuously updated inventory of all network appliances and their patch status, prioritizing internet-facing assets.\n- Establish an emergency patching SLA (e.g., 24–72 hours) for critical CVEs affecting perimeter or load-balancing infrastructure.\n- Implement network segmentation to limit lateral movement opportunities if a BIG-IP or similar appliance is compromised.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST CM-6: Configuration Settings","NIST RA-5: Vulnerability Monitoring and Scanning","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1055: Process Injection","MITRE ATT&CK T1562.001: Disable or Modify Security Tools",{},"published","2026-09-08T22:22:35.398581+00:00","2026-09-08T22:22:35.275+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit\u002F","hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit-11f562","Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"f423b0be-9fcc-4ff7-8bbc-35f9e7caffe4","2026-09-09","morning","ThreatNoir Morning Brief — September 9","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-09\u002Fthreatnoir-morning-brief-2026-09-09.mp3",[59,62,65],{"slug":36,"name":60,"problem":61},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":48,"name":63,"problem":64},"Automated patch management","Known holes get closed in days, not months.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]