MalwareExploits 1 CVE

Linux/Agnt-IC

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-53521Unauthenticated RCE in F5 BIG-IP APMExploited in the wild

F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server.

via security affairssecurityaffairs.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

“The initial access vector is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM when an access policy is configured on a virtual server.”

Execution

2 techniques

T1059.004Unix ShellEvidence2

“Sophos also found the implant deploying a Unix domain to socket to offer another path of communicating with an infected system and launching a shell.”

T1574.006Dynamic Linker HijackingEvidence1

“The second-stage malware is a standalone Linux ELF binary that includes its own loader instead of relying on the normal Linux loader. When it starts, it intercepts libc_start_main.” It also hooks Apache's apr_dso_load function.

Persistence

1 technique

T1505.003Web ShellEvidence2

“The malware can install malicious PHP code directly into the running web server’s memory” and “The installed web shell gets specially tailored HTTP requests and runs commands given by the threat actor.”

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

“[It] manipulat[es] mmap behavior inside libphp at runtime – so that only the infected process sees the malicious content and nothing ever touches the disk.”

Stealth

6 techniques

T1014RootkitEvidence1

“Sophos X-Ops has found an advanced Linux rootkit that can conceal a PHP web shell completely in server memory.”

T1027Obfuscated Files or InformationEvidence1

“The binary also encrypts its operational strings with RC4 using the hardcoded key TrswBWIl90Z5e38n. It decrypts them only when needed.”

T1036MasqueradingEvidence1

“To make its traffic look normal, it responds with HTTP status 201 and sets the content type to text/css. This makes the response look like a successful CSS file request on a BIG-IP APM device.”

T1055Process InjectionEvidence1

“[It] manipulat[es] mmap behavior inside libphp at runtime – so that only the infected process sees the malicious content and nothing ever touches the disk.”

T1574.006Dynamic Linker HijackingEvidence1

T1620Reflective Code LoadingEvidence1

“It changes how PHP files are shown to the running Apache process while the original files on disk are left unchanged.”

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

“The installed web shell gets specially tailored HTTP requests and runs commands given by the threat actor.”

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

“A file scan could demonstrate that a PHP is authentic even when the server is actively running malicious code.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app24 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cysecurity newsNews

Sep 10, 2026

F5 BIG-IP APM Malware Installs a PHP Web Shell Into Memory, Escaping Disk Scans - CySecurity News - Latest Information Security and Hacking Incidents

A Linux rootkit for targeted F5 BIG-IP APM/Apache/PHP environments. It preserves legitimate PHP files on disk while modifying their in-memory representation to deploy a memory-resident PHP web shell. It monitors Apache for PHP-module loading, integrates with system startup, supports command execution through tailored HTTP requests, and creates a Unix-domain socket as an additional shell-access channel.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Linux/Agnt-IC

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-53521Unauthenticated RCE in F5 BIG-IP APMExploited in the wild

F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server.

via security affairssecurityaffairs.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

“The initial access vector is CVE-2025-53521, an unauthenticated remote code execution flaw in BIG-IP APM when an access policy is configured on a virtual server.”

Execution

2 techniques

T1059.004Unix ShellEvidence2

“Sophos also found the implant deploying a Unix domain to socket to offer another path of communicating with an infected system and launching a shell.”

T1574.006Dynamic Linker HijackingEvidence1

Persistence

1 technique

T1505.003Web ShellEvidence2

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

“[It] manipulat[es] mmap behavior inside libphp at runtime – so that only the infected process sees the malicious content and nothing ever touches the disk.”

Stealth

6 techniques

T1014RootkitEvidence1

“Sophos X-Ops has found an advanced Linux rootkit that can conceal a PHP web shell completely in server memory.”

T1027Obfuscated Files or InformationEvidence1

“The binary also encrypts its operational strings with RC4 using the hardcoded key TrswBWIl90Z5e38n. It decrypts them only when needed.”

T1036MasqueradingEvidence1

“To make its traffic look normal, it responds with HTTP status 201 and sets the content type to text/css. This makes the response look like a successful CSS file request on a BIG-IP APM device.”

T1055Process InjectionEvidence1

“[It] manipulat[es] mmap behavior inside libphp at runtime – so that only the infected process sees the malicious content and nothing ever touches the disk.”

T1574.006Dynamic Linker HijackingEvidence1

T1620Reflective Code LoadingEvidence1

“It changes how PHP files are shown to the running Apache process while the original files on disk are left unchanged.”

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

“The installed web shell gets specially tailored HTTP requests and runs commands given by the threat actor.”

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

“A file scan could demonstrate that a PHP is authentic even when the server is actively running malicious code.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app24 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cysecurity newsNews

Sep 10, 2026

F5 BIG-IP APM Malware Installs a PHP Web Shell Into Memory, Escaping Disk Scans - CySecurity News - Latest Information Security and Hacking Incidents

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.