Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit
Attackers have compromised F5 BIG-IP APM devices by deploying a Linux rootkit that injects a web shell directly into memory, leaving no files on disk and making detection significantly harder for defenders.
Why this matters: F5 BIG-IP devices sit at the front door of corporate and government networks, handling authentication and access control. A rootkit that lives only in memory is harder to catch because most security tools look for files. If attackers own the device that decides who gets in, they can move anywhere behind it. Organizations running these devices need to know this is happening now, not after a post-breach review.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.