A stealthy fileless rootkit has been uncovered targeting F5 BIG-IP Access Policy Manager (APM) appliances, operating purely in memory to evade nearly all conventional security tools. The malware represents a dangerous evolution in attack techniques against critical network infrastructure.
According to a technical analysis published on September 8, 2026, the implant—dubbed "PoisonedRefresh" by ESET—was discovered in compromised F5 BIG-IP APM environments. The research detailed how the rootkit was found planted in these critical network appliances.
The core mechanism of PoisonedRefresh is its ability to inject malicious PHP web shells directly into the memory space of the Apache web server process on the target F5 device. By executing entirely from RAM, the rootkit leaves no files or artifacts on the disk, rendering traditional antivirus, file integrity monitoring, and many endpoint detection and response (EDR) systems ineffective.
The F5 BIG-IP APM is a high-value asset in many corporate networks, handling secure remote access and session management. Its compromise provides attackers with a privileged internal foothold, enabling credential theft, data exfiltration, and lateral movement throughout the network.
This incident highlights a broader industry trend: attackers are increasingly adopting fileless, memory-resident techniques to bypass security stacks built around signature-based detection. For defenders, this necessitates a paradigm shift toward behavioral monitoring and memory forensics.
Effective detection now depends on tools capable of inspecting the runtime memory of critical processes and monitoring for anomalous behavior, such as unexpected outbound network connections from network appliances. Security teams must extend their vulnerability management and monitoring programs to explicitly include network infrastructure as critical assets.
For technology-dependent sectors, the emergence of PoisonedRefresh is a stark reminder. The stealth of such attacks means organizations can no longer rely solely on perimeter defenses or disk-based scans. A proactive defense posture, incorporating threat hunting and continuous behavioral analysis, is essential for protecting vital systems from these adaptive adversaries.
一款隱匿性極強的無檔案Rootkit被發現針對F5 BIG-IP存取策略管理器(APM)設備，其完全於記憶體內運作以規避幾乎所有常規安全工具。該惡意軟件代表針對關鍵網絡基礎設施攻擊手法的危險演進。
根據於2026年9月8日發表的一份技術分析，該植入體——由ESET命名為「PoisonedRefresh」——在遭入侵的F5 BIG-IP APM環境中被發現。研究詳細描述了如何在這些關鍵網絡設備中發現該Rootkit被植入。
PoisonedRefresh的核心機制在於能將惡意PHP網頁外殼直接注入目標F5設備上Apache網頁伺服器行程的記憶體空間。由於完全從RAM執行，該Rootkit不會在磁碟留下任何檔案或殘留數據，致使傳統防毒軟件、檔案完整性監控系統及許多端點偵測與回應(EDR)系統失效。
F5 BIG-IP APM在企業網絡中屬高價值資產，負責處理安全遠端存取與會話管理。其遭入侵將為攻擊者提供特權內部據點，便利進行憑證竊取、數據外洩及橫向移動。
此事件突顯更廣泛的行業趨勢：攻擊者日益採用無檔案、常駐記憶體的技術，以繞過基於特徵碼檢測所構建的安全防禦體系。對防禦方而言，這意味著必須轉向行為監控與記憶體取證的範式。
現今有效的偵測依賴能檢查關鍵行程執行時記憶體的工具，並監控異常行為，例如來自網絡設備的異常外部連線。安全團隊必須擴展其漏洞管理與監控計劃，明確將網絡基礎設施納入關鍵資產範疇。
對技術依賴型產業而言，PoisonedRefresh的出現是一記警鐘。此類攻擊的隱蔽性意味著組織不能再僅依賴周邊防禦或基於磁碟的掃描。採取主動防禦姿態，整合威脅狩獵與持續行為分析，對保護關鍵系統免受這些適應性對手攻擊至關重要。