Approximately a month ago, F5 published advisory on malware deployed to BIG-IP systems vulnerable to CVE-2025-53521. #ESETresearch discovered two related malware components on VirusTotal and named the threat #PoisonedRefresh. https://my.f5.com/manage/s/article/K000160486 First, umount infects /usr/sbin/httpd by prepending a malicious ELF binary to the legitimate binary, as long as the first command-line argument is /mnt/tm_install/<dir>. The sample is expected to be run as root and will disable SELinux. Interestingly, for /mnt/tm_install/usr, the sample also infects umount, httpd, and rc.local files located within the tm_install directory. This is presumably done to infect the installation media, allowing the malware to persist and spread to other BIG-IP systems. Although attribution is still undecided, the initial access vector and deployed malware suggest a sophisticated threat actor. Note that benign functionality is preserved. Therefore, follow F5's security advisory to identify potential compromise. IoC: 🚨PoisonedRefresh E5066C2490197FFBE0E916BC232114A61CB09A16 7A2FC3510B502D8FDC2548F907AF08308840851C E2D6C74E815A07F555CD678F7AD0EFEDEAE98ECD