Malware Activity
Fileless Linux Rootkit Targets F5 BIG-IP APM Through In-Memory Web Shell Injection
A sophisticated Linux rootkit dubbed PoisonedRefresh is targeting F5 BIG-IP Access Policy Manager (APM) environments, using advanced Linux and Apache hooking techniques to inject a fileless PHP web shell directly into memory while leaving legitimate PHP files on disk untouched. Sophos assesses the malware as a likely second-stage payload deployed following exploitation of CVE-2025-53521, a critical remote code execution (RCE) vulnerability in F5 BIG-IP, with an unidentified installer or propagation component modifying the Apache /usr/sbin/httpd executable, altering SELinux configurations, and establishing persistence across BIG-IP upgrades. Once Apache starts, the rootkit intercepts __libc_start_main and the Apache Portable Runtime module loader to hook PHP operations, dynamically injecting its web shell into legitimate BIG-IP APM webtop scripts such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3. Attackers can send specially crafted requests that are decrypted and executed through PHP’s eval() function, with results returned as HTTP 201 responses disguised as CSS content, helping conceal malicious activity. The implant also establishes a password-protected local UNIX socket capable of launching an interactive Bash shell without exposing a TCP listening port and deliberately delays backdoor initialization to blend into normal Apache activity. Defenders should investigate Apache processes accessing /proc/self/maps, changes to libphp memory protections, creation of /run/bigtlog.pipe, unexpected /bin/bash execution, and unusual POST requests or HTTP 201 text/css responses involving the targeted .php3 endpoints. The Shadowserver Foundation reportedly identified 795 internet-exposed BIG-IP APM endpoints vulnerable to CVE-2025-53521, highlighting the potential attack surface for environments that remain unpatched. CTIX analysts will continue to report on novel and interesting tactics, techniques and procedures.
Threat Actor Activity
ShinyHunters Claims Breach of Florida DMV Driver Database
ShinyHunters, a prolific extortion gang, claims to have breached Florida’s Driver and Vehicle Information Database (DAVID), used by law enforcement to look up driver records, and stolen data on more than 200,000 drivers. As proof, ShinyHunters published a screenshot of Jeffrey Epstein’s DMV record, showing address, Social Security Number (SSN), birth date, license details, and registered vehicles. The hacker group told BleepingComputer they exploited a password‑reset flaw to compromise multiple DAVID accounts, allegedly belonging to DMV employees and an FBI agent, then iterated through driver IDs to download associated HTML and images. They say access has since been cut off and the flaw is being patched. ShinyHunters also claim they are targeting other states’ DMV platforms via social engineering and expect to announce more breaches. Active since 2018, the ShinyHunters extortion gang is known for large‑scale data theft and extortion, associated with numerous major data‑theft and extortion incidents. Initially focused on Salesforce and other cloud SaaS environments, they’ve hit companies like Google, Cisco, Pornhub, and Match Group, often via third‑party integrators and stolen tokens. More recently they’ve adopted vishing and device‑code attacks against Okta, Microsoft, and Google SSO to hijack access to services like Microsoft 365 and Google Workspace. Despite multiple arrests tied to Snowflake, PowerSchool, and the Breached v2 forum, actors using the ShinyHunters brand remain active and dangerous. CTIX Analysts will continue to publish the most relevant and timely updates around threat actor activity and campaigns
Vulnerabilities
Cisco Confirms Active Exploitation of Critical Secure FMC Authentication Bypass
Cisco has confirmed active exploitation of a maximum-severity (CVSS 10/10) authentication bypass vulnerability affecting Secure Firewall Management Center (FMC) that allows unauthenticated remote attackers to execute scripts and commands with root privileges. The flaw, tracked as CVE-2026-20079, is caused by an improperly created system process at boot, and can be exploited through maliciously crafted HTTP requests to the device’s web interface. The vulnerability also affects Cisco Security Cloud Control Firewall Management, although Cisco has already patched its cloud-hosted service. While Cisco says its PSIRT became aware of exploitation in August, indicators of compromise published in July 2026 (including a July 23 log entry involving /var/tmp/license.tmp) suggest attacks may have begun earlier. Notably, the indicators and hot fixes overlap with CVE-2026-20316, a separately exploited static-credential vulnerability disclosed in July, suggesting the two (2) flaws may have been leveraged together in the same attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) Catalog, requiring all federal civilian agencies to remediate affected systems by no later than September 12, 2026. Cisco says no workarounds are available and urges customers to upgrade immediately. CTIX analysts stress that while applying fixes prevents future exploitation, it does not remediate systems that have already been compromised.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
