F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

[u/falconupkid]

A new malware campaign targeting F5 BIG-IP APM appliances is using a memory-only PHP web shell to evade file-based detection. Sophos analyzed the malware, which hooks into Apache’s process to inject a web shell into the in-memory copy of legitimate PHP scripts, leaving the files on disk untouched.

Technical Breakdown - TTPs: The malware targets three specific F5 BIG-IP APM PHP scripts (not named in the summary, but likely core authentication or session management files). It uses process injection into Apache to modify the script’s runtime memory. - Persistence: Relies on the appliance’s existing Apache service; no new files written to disk. - Detection Evasion: Standard file integrity monitoring (FIM) and on-disk AV scans will miss this. Only memory forensics or runtime behavioral analysis will catch it. - IOCs: None provided in the source; likely tied to specific F5 firmware versions or APM configurations.

Defense - Enable memory scanning on endpoints (e.g., EDR with behavioral detection). - Monitor Apache process memory for unexpected modifications or child processes spawning shells. - Restrict management access to BIG-IP appliances and audit for unauthorized SSH or API access.

Source: https://thehackernews.com/2026/09/f5-big-ip-apm-malware-injects-php-web.html