The rootkit found inside F5 BIG-IP Access Policy Manager environments does not write files. It hooks the PHP file-loading process and injects a fileless web shell straight into memory, which means every disk-based integrity check a bank runs against its BIG-IP estate this week will come back clean. That is not a design flaw in the detection tooling. It is the design goal of the rootkit.

Hong Kong and Singapore banks running BIG-IP APM as their access-control front end sit inside the scope of the HKMA's Technology Risk Management guideline, which assumes periodic configuration and integrity reviews catch drift. A review that only reads disk state now misses the compromise entirely. The check that would have caught this is memory forensics on the APM host, not a file hash comparison, and few TRM audit programmes currently ask for one.

Pair this with Tuesday's Patch Tuesday load: Microsoft shipped fixes for 974 flaws, two already under active exploitation, the same week CISA moved N-able N-central's pre-authentication remote-code-execution bug into its Known Exploited Vulnerabilities catalog. Patching cadence is not the control that stops the F5 rootkit. Runtime memory inspection on internet-facing access infrastructure is, and it belongs on the audit list before the next TRM review, not after an incident report explains why it wasn't there.