F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans
-
Malware tied to intrusions on F5 BIG-IP Access Policy Manager appliances conceals a PHP web shell in memory rather than in a file on disk, according to an analysis from Sophos published on September 7.
The technique works by hooking into the appliance's own PHP scripts. When Apache loads any of the three affected scripts, the malware appends the web shell to the in-memory copy of that script. Because the file on disk is never modified, a routine file inspection can return a clean result even while the web shell is active in memory.
The three scripts abused in this manner are:
- The appliance's own PHP scripts loaded by Apache (three in total, per Sophos)
This memory-resident approach means defenders relying solely on disk-based scanning may miss the compromise entirely. Because the injected code lives only in the running process, detection typically requires memory inspection or monitoring for anomalous behavior rather than file integrity checks.
Note: The source article does not provide specific CVE identifiers or file paths for this activity.
Source: The Hacker News
Has anyone here dealt with memory-only web shells on BIG-IP APM, and what detection approach worked for you?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login