Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices
A Linux rootkit targets F5 BIG-IP APM devices by injecting fileless web shells into memory through PHP file loading interception, complicating detection.
Why it matters
This rootkit employs memory-resident techniques that bypass disk detection, posing a significant challenge to identifying and responding to compromises in critical network appliances.
SOC impact
Focus monitoring on memory-based anomalies and web shell activity within F5 BIG-IP APM environments. Investigate unusual PHP execution patterns and intercepts that may indicate rootkit presence. Validate the scope of affected devices to assess risk and tailor response efforts accordingly.
Recommended actions
- Monitor PHP file loading behavior for signs of interception or injection
- Analyze memory for signs of fileless web shells on F5 BIG-IP APM devices
- Review network appliance logs for abnormal access patterns or requests
- Identify and inventory all F5 BIG-IP APM devices within the environment
- Correlate suspicious activity with threat intelligence related to Linux rootkits
Executive Summary
A Linux rootkit campaign has been observed compromising F5 BIG-IP APM devices by injecting fileless web shells directly into memory. This infiltration method avoids writing to disk, rendering traditional detection methods less effective. The rootkit manipulates PHP file loading, enabling attackers to execute malicious code stealthily within critical enterprise network infrastructure. Cybersecurity teams must adjust detection strategies to focus on live memory analysis and monitoring of PHP execution behaviors specific to these devices.
SOC Impact
Focus monitoring on memory-based anomalies and web shell activity within F5 BIG-IP APM environments. Investigate unusual PHP execution patterns and intercepts that may indicate rootkit presence. Validate the scope of affected devices to assess risk and tailor response efforts accordingly.
Memory and Web Shell Activity Validation
- Monitor PHP file loading behavior for signs of interception or injection
- Analyze memory for signs of fileless web shells on F5 BIG-IP APM devices
- Review network appliance logs for abnormal access patterns or requests
- Identify and inventory all F5 BIG-IP APM devices within the environment
- Correlate suspicious activity with threat intelligence related to Linux rootkits
Why It Matters
This rootkit employs memory-resident techniques that bypass disk detection, posing a significant challenge to identifying and responding to compromises in critical network appliances.