F5 BIG-IP APM Malware Hides PHP Web Shell in Memory to Evade Disk Scans

Wed, 09 Sep 2026 15:05:56 +0000

Engineer — Act: F5 BIG-IP APM is a widely-deployed enterprise edge appliance and the malware is linked to confirmed break-ins; disk-based file integrity checks won’t detect this web shell, so audit BIG-IP APM instances using network-based IOCs and memory forensics from the Sophos September 7 analysis.
SOC/IR — Act: Active exploitation of an edge appliance combined with a memory-resident web shell means EDR and file-scan detections will miss it; assume-breach posture applies — hunt using any network or request-pattern IOCs from the Sophos report and flag all BIG-IP APM devices for manual inspection.
Leader — Act: If your organization runs F5 BIG-IP APM, direct the security team to perform a compromise assessment this week — the memory-evasion technique means standard monitoring may have already missed a breach on this access gateway.

Memory-Injection on CuraSec