Sophos Details Malware Hiding in F5 Big-ip APM Intrusions

Sophos researchers have detailed malware tied to intrusions at F5 BIG-IP Access Policy Manager (APM) appliances that conceals a PHP backdoor. The malware, which remains undetected by traditional security tools, is designed to maintain persistent access to compromised devices. The researchers noted that the intrusions likely targeted organizations using F5's APM for remote access, and they urged administrators to review their systems for signs of compromise.