This technique is notable because it subverts the normal execution flow of the web application server, meaning that even routine file integrity checks may miss the compromise. The rootkit's in-memory payload enables attackers to maintain control over the affected BIG-IP APM appliance while avoiding common forensic signatures.

• The rootkit targets F5 BIG-IP APM environments.
• It intercepts PHP file loading to inject the web shell.
• The web shell is fileless, residing solely in memory.
• No malicious code is written to the disk.

Given the privileged position of these devices in network infrastructure, successful exploitation could allow attackers to intercept or manipulate authentication traffic, potentially affecting broader access controls. Organizations running F5 BIG-IP APM should verify the integrity of their devices and review any unusual PHP activity or unexpected memory-resident processes.

Source: BleepingComputer

Are any of you running F5 BIG-IP APM appliances — and if so, what detection measures are you using to spot memory-only implants like this rootkit?