F5 BIG-IP APM DEVICES TARGETED BY LINUX ROOTKIT

The rootkit targets F5 BIG-IP Application Performance Monitoring (APM) systems, exploiting them as entry points for infrastructure compromise. Rather than writing malicious files to disk—where security tools typically detect them—the rootkit operates as a fileless attack, injecting a web shell directly into system memory. This technique allows attackers to maintain persistent access while evading traditional endpoint detection systems. The PHP file interception capability enables the rootkit to modify application behavior at runtime, potentially granting unauthorized access or enabling data exfiltration. F5 BIG-IP devices are widely deployed in enterprise networks for load balancing and application security, making them high-value targets. Organizations running vulnerable APM instances should review access logs and apply available security patches. The breach underscores the growing threat posed by fileless malware techniques that exploit legitimate system processes to avoid detection.