Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

The PoisonedRefresh rootkit exploits CVE-2025-53521, a critical vulnerability in F5 BIG-IP APM devices that had not been patched on affected systems. By injecting a fileless web shell directly into memory and infecting the Apache httpd binary, attackers evade traditional disk-based detection tools entirely. The malware further entrenches itself by tampering with SELinux configurations — a mandatory access control mechanism — effectively disabling a key defensive layer. This attack illustrates how unpatched network appliances, especially those exposed to the internet, represent high-value entry points that can be compromised with devastating stealth. Organizations that rely solely on file-based antivirus or lack memory-level inspection are particularly blind to this class of threat.