Cyber CrimeRootkit hides web shells in F5 BIG-IP memory
Sophos says a tailored Linux rootkit lets attackers run web shells inside F5 BIG-IP APM without leaving malicious PHP on disk.
> Search
2 results for “cve-2025-53521”
2 results for “cve-2025-53521”
Cyber CrimeSophos says a tailored Linux rootkit lets attackers run web shells inside F5 BIG-IP APM without leaving malicious PHP on disk.
SecurityF5 BIG-IP APM malware hides a PHP web shell purely in memory, evading file checks, Sophos analysis shows.