FreePBX: Cyble reports INJ3CTOR3 malware now steals SIP trunk credentials

What happened

The Cyber Express reports that Cyble Research & Intelligence Labs (CRIL) found a new capability in JOMANGY, the PHP webshell used by the INJ3CTOR3 toll-fraud operation against FreePBX (The Cyber Express). According to the outlet, CRIL analyzed artifacts collected from the operator’s staging servers on 9 September 2026. CRIL says the implant now sends SIP trunk, AMI, database and mail-relay credentials off the server. CRIL’s conclusion is that wiping an infected host no longer ends the fraud. These findings come from a single vendor, relayed by one outlet. Independent verification is not confirmed.

According to the report:

• New exfiltration step. The September version of the k.php script includes two base64-encoded lines. Each line holds 17 curl commands that upload configuration files from FreePBX, Issabel and Elastix systems to /hima_data/index.php.
• Repeated theft. Cron beacons rerun k.php every minute. CRIL says passwords changed while a system is still infected leak within minutes.
• Calls placed outside the victim’s PBX. With a stolen trunk secret, CRIL says attackers can register with the carrier from anywhere and place calls that never touch the victim’s PBX. The exception is a carrier that limits the trunk to the victim’s IP addresses.
• Admin password changes do not lock attackers out. The panel can reportedly forge a FreePBX admin session through the ampuser class and setAdmin().
• Hidden access path. The malware plants an .htaccess file in /var/www/html/admin/views/. It routes requests containing an encoded space or tab (such as %20 or %09) to config.php. Access logs then never show the webshell’s filename.
• Trunks hidden from the console. Trunks written directly to /etc/asterisk files such as pjsip_custom.conf do not appear in the FreePBX console.

The outlet gives this background on the group:

• Check Point Research named INJ3CTOR3 in 2020 for exploiting CVE-2019-19006 in FreePBX.
• Unit 42 linked the group to attacks on Elastix in 2022.
• Fortinet documented its EncystPHP webshell in January 2026.
• Shadowserver counted more than 900 compromised FreePBX instances in February 2026 and over 700 still infected in May.
• Sangoma’s patch for CVE-2025-57819 blocks new exploitation but does not clean systems that are already compromised.

Fixed version numbers are not confirmed in the source.

Am I affected?

You may be affected if you run FreePBX, Issabel or Elastix and the system was exposed to the internet, especially if it was unpatched against CVE-2025-57819. The source does not give a full list of affected versions.

Indicators reported by The Cyber Express, citing CRIL:

• C2 hosts: 160[.]119[.]69[.]4 (plain-text commands) and 45[.]95[.]147[.]178 (base64-encoded commands). Both receive credential uploads. Both reportedly stopped responding in late September.
• New watermarks: trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e. These replace the earlier trace_e1ebf9066a951be519a24140711839ea.
• Gate hash: the MD5 gate hash changed from a2f6863413c4192a4abfa360577b9961 to 8b3a1d970fda0c17a0b785a990fb7b6a.
• Backdoor account: an account named “hima”.
• Persistence: cron entries rerunning k.php and a “zen2” watchdog.
• Other artifacts: an unexpected .htaccess file in /var/www/html/admin/views/, and trunks in Asterisk config files that are missing from the FreePBX console.

What to do now

1. Apply Sangoma’s patch for CVE-2025-57819 if you have not already done so. It blocks new exploitation but does not clean an existing infection.
2. If you suspect compromise, isolate the host from the internet. This is the first step in the cleanup order CRIL recommends, as reported by The Cyber Express.
3. Preserve crontabs, logs and the ampusers table before you change anything.
4. Remove the cron entries and the zen2 watchdog. The rest of CRIL’s cleanup sequence is cut off in the available source text and is not confirmed here.
5. Audit trunks with Asterisk CLI commands such as pjsip show endpoints and compare the results with what the FreePBX console lists.
6. Rotate SIP trunk, AMI, database and mail-relay credentials only after the host is clean. Per CRIL, credentials changed while the system is still infected leak within minutes.
7. Ask your carrier whether your trunk can be limited to your own IP addresses. The report names this as the case where stolen trunk secrets cannot be used from elsewhere.

Sources

• The Cyber Express: INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup