F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Sophos researchers uncovered a sophisticated memory-based evasion technique in malware targeting F5 BIG-IP Access Policy Manager (APM) appliances. The attack injects a PHP web shell directly into memory rather than storing it on disk, allowing the malicious code to persist while evading traditional file-system scans.

The malware operates by intercepting Apache's loading process. When the BIG-IP system loads any of three critical PHP scripts native to the appliance, the malware modifies the in-memory copy to include the web shell payload. This creates a divergence between what exists on disk (which appears clean) and what runs in the application's memory space (which contains the backdoor). Disk-based detection tools and forensic scans fail to identify the threat because the malicious code never touches the filesystem.

F5 BIG-IP APM handles access control, authentication, and policy enforcement for enterprise networks. Compromising these appliances gives attackers a foothold within protected network perimeters and potential access to sensitive systems behind them. The ability to maintain persistent web shell access while evading disk scans represents a significant operational security advantage for threat actors.

Sophos published its analysis on September 7, providing technical details of the technique. The research ties this malware to previously identified break-ins at BIG-IP systems, suggesting coordinated intrusion activity. Memory-based persistence techniques have grown more common in advanced persistent threats, where attackers prioritize stealth over obvious presence.

The attack chain likely begins with exploitation of known BIG-IP vulnerabilities. F5 has patched multiple remote code execution flaws in APM over the past two years. Initial access allows threat actors to execute code and inject the malicious PHP logic into the Apache process. From there, every request to the affected PHP scripts loads the web shell into memory, giving attackers a backdoor for command execution and lateral movement.

This technique complicates incident response significantly. Standard endpoint detection and response tools that scan disk artifacts will miss the threat. Security teams investigating BIG-IP compromises must monitor running processes, examine Apache memory dumps, and inspect network traffic patterns rather than relying solely on file integrity checks. Log analysis becomes critical, as the web shell activity leaves traces in Apache access logs even though no file exists on disk.

Organizations running F5 BIG-IP APM should immediately verify their patch status against known CVEs affecting these systems. Network segmentation limiting BIG-IP exposure to trusted administrators reduces the attack surface. Behavioral monitoring of Apache processes and memory inspection tools help detect memory-resident web shells. Sophos recommends examining system logs for suspicious PHP requests and examining loaded modules within running Apache instances.

The discovery underscores a broader trend in threat actor sophistication. As security tools improve at detecting disk-based malware, attackers shift to fileless and memory-resident techniques. Living-off-the-land approaches that leverage legitimate system components like Apache and PHP native functionality make threats harder to distinguish from normal operations. Defense requires moving beyond filesystem scanning toward runtime behavior analysis and memory forensics capabilities.