The threat involves a Linux rootkit that compromises F5 BIG-IP APM devices by intercepting PHP file loading and injecting a fileless web shell into memory. This method bypasses disk-based detection mechanisms by avoiding writing malicious files to storage. The rootkit targets the application delivery controller environment provided by F5 BIG-IP APM, enabling attackers to maintain stealthy access and potentially control over the device. No specific affected versions or CVE identifiers are provided. There is no indication of known exploits in the wild or vendor patches at this time.

The rootkit enables attackers to maintain stealthy, persistent access to compromised F5 BIG-IP APM devices by injecting malicious code directly into memory. This can lead to unauthorized control, interception of PHP processes, and potential further compromise of network infrastructure relying on these devices. The fileless nature of the web shell complicates detection and incident response efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or guidance are available, organizations should monitor for unusual activity on F5 BIG-IP APM devices and apply any recommended security best practices from F5. No vendor advisory or patch information is currently provided.