PoisonedRefresh Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

September 7, 2026

Last Seen

September 7, 2026

Related Threat Clusters

Advanced PHP Web Shell Exploits F5 BIG-IP Systems
A sophisticated Linux implant targeting F5 BIG-IP Access Policy Management (APM) environments has been identified, exploiting CVE-2025-53521, an unauthenticated remote code execution vulnerability. This malware,…

5 articles · Updated September 7, 2026

Recent Intelligence Reports

PoisonedRefresh Malware Backdoors F5 BIG-IP Servers With Memory — Gbhackers · September 7, 2026
Dissecting a PHP web server rootkit — News.Sophos · September 7, 2026

Related Entities

Malware F5 CVE-2025-53521 CWE-798 - Use of Hard-coded Credentials CWE-94 - Code Injection China Chopper T1027 - Obfuscated Files Or Information T1055 - Process Injection T1190 - Exploit Public-Facing Application T1505.003 - Web Shell Apache Apache Portable Runtime