F5 BIG-IP malware hides web shells in memory to evade detection

Stealthy malware tied to break-ins on F5 BIG-IP Access Policy Manager (APM) appliances let attackers hide PHP web shells in memory as opposed to a file on disk.

In a Sept. 7 blog post, Sophos said what’s different here is that the malware demonstrates advanced techniques to evade detection, such as custom executable and linking format (ELF) loading, function hooking, and runtime code patching.

The researchers said the results are familiar to what we’ve seen on other attacks on network infrastructure: on-demand server-side code execution commonly associated with web shells but implemented using deeper Linux and Apache-specific tradecraft.

Damon Small, a board member at Xcape, explained that traditional defenses often depend on detecting changes to files written to disk. By existing solely in memory, Small said those controls are left ineffective. 

“Therefore, defenders need to become more sophisticated just as the adversary has by monitoring not just file activity, but processes that are active in memory,” said Small. “This can be achieved through advanced products that monitor active processes in memory and can stop those that are unauthorized from running.”

Rogier Fischer, co-founder and CEO at Hadrian, added that by interfering with the way Apache and PHP load legitimate BIG-IP files and injecting the web shell into the version held in memory, the malware makes it harder for defenders to identify a compromise. Fischer said the consequences are serious because a web shell effectively gives an attacker a way to send commands to the compromised appliance through web requests.

“This makes mitigating exposure a priority for security teams, but patching alone is not enough if the appliance may already have been compromised,” said Fischer. “Where teams cannot establish confidence that an exposed appliance is clean, rebuilding it from a trusted state may be safer than relying solely on conventional malware scans.”

John Strand, owner of Black Hills Information Security, said the F5 BIG-IP vulnerability involving a web shell that exists in memory isn’t really a new technique: Memory-resident malware has been around for an incredibly long time. It goes all the way back to advanced research like Shadow Walker, which was presented at Black Hat years ago.

“What makes this interesting, and frankly pretty insidious, is where it’s running,” said Strand. “With desktops and servers, we’ve built an entire security ecosystem around EDR. We expect agents to be there scanning memory, collecting telemetry, looking at processes, and identifying unusual behavior. With appliances like these, you often don’t have that. There simply aren’t a lot of EDR products you can drop onto a network appliance and expect the same level of visibility.”

Strand said there’s another concern with memory-resident attacks against specialized appliances. If an attacker gets sufficient privileges, Strand said there’s the potential to move deeper into the device, including firmware.

“At that point, eradication can become incredibly difficult,” said Strand. “Once we get off the shiny, happy path of standard desktops and servers, a lot of the security capabilities we take for granted start disappearing. Visibility, blocking, telemetry, memory analysis, and endpoint detection may simply not exist. That’s what makes attacks against these appliances particularly dangerous.”

Sam Decker, threat intelligence engineer at Blackpoint Cyber, added that most web shells are just a file sitting in the web root, easy enough to catch when antivirus or endpoint monitoring watches the disk. Decker said network appliances typically don't have that kind of monitoring, so there's no scan to evade in the first place.

“This malware goes further still, patching the Apache binary and hooking the PHP module loader so the web shell gets spliced into legitimate scripts only when they load into memory,” said Decker. “Even someone who did check the disk would find everything looking stock, since the malicious code was never written there to begin with.”