A recent analysis by Sophos has revealed a malware strain that targets F5 BIG-IP Access Policy Manager appliances. This malware is particularly stealthy, as it injects a PHP web shell into the memory of the appliance rather than writing it to disk, making it invisible to traditional file-based security scans. The malware activates when Apache loads specific PHP scripts associated with the appliances, allowing attackers to maintain control without leaving obvious traces. This incident raises concerns for organizations using these appliances, as it highlights the need for enhanced monitoring of memory and runtime behavior in addition to standard disk checks. Companies should review their security measures to protect against this type of attack.