The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May.
It has since analyzed artifacts collected from the operator’s staging servers on 9 September 2026 and found that the implant now sends victims’ SIP trunk, AMI, database, and mail-relay credentials off the server. As a result, wiping an infected host no longer ends the fraud.
INJ3CTOR3 has targeted Asterisk-based phone systems since at least 2020. That November, Check Point Research named the group for exploiting CVE-2019-19006 in FreePBX. Unit 42 linked it to attacks on Elastix in 2022, and Fortinet documented its EncystPHP webshell in January 2026.
How JOMANGY Now Exfiltrates FreePBX Secrets
The September version of the k.php script ends with two new base64-encoded lines. Each line holds 17 curl commands that upload configuration files from FreePBX, Issabel, and Elastix systems to /hima_data/index.php.
Cron beacons rerun k.php every minute, so the theft repeats constantly. If a victim changes passwords while the system is still infected, the new passwords leak within minutes. With a stolen trunk secret, attackers can register with the carrier from anywhere and place calls that never touch the victim’s PBX. The only exception is when the carrier limits the trunk to the victim’s IP addresses.
The “hima” name matches a backdoor account the malware creates. It also matches a Telegram user Check Point spotted in 2020 sharing a tool that scanned and cracked SIP ranges.
Plain-text commands now point to 160[.]119[.]69[.]4, while base64-encoded commands still reach 45[.]95[.]147[.]178. The credential upload targets both hosts. Both hosts stopped responding in late September. CRIL is urging law enforcement agencies and national CERTs to work with hosting providers to preserve the server data and sinkhole the addresses.
INJ3CTOR3 Rotates the Indicators Defenders Relied On
The core JOMANGY code is largely unchanged, but the identifiers defenders were told to hunt for have changed:
- Watermark: The single April watermark (trace_e1ebf9066a951be519a24140711839ea) has been replaced by per-build values: trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e.
- Gate hash: The MD5 gate hash shared by JOMANGY and ZenharR moved from a2f6863413c4192a4abfa360577b9961 to 8b3a1d970fda0c17a0b785a990fb7b6a.
- Takeover script: The /x script grew from 367 to 620 lines, mostly to remove rival actors’ implants and SSH keys.
The panel can also forge a FreePBX admin session through the ampuser class and setAdmin(). This means changing the admin password does not lock the attacker out.
Hidden Doors in Compromised FreePBX Systems
The malware plants an .htaccess file in /var/www/html/admin/views/. It routes any request containing an encoded space or tab, such as %20 or %09, to config.php. Access logs record only the requested path, never the webshell’s filename, so searching logs for the shell by name can come up empty.
Trunks written directly to /etc/asterisk files such as pjsip_custom.conf also stay invisible in the FreePBX console. Administrators should audit through Asterisk CLI commands such as pjsip show endpoints and compare the results with what the console lists.
Cleaning Up After INJ3CTOR3
Shadowserver counted more than 900 compromised FreePBX instances in February 2026, and over 700 were still infected in May. Sangoma’s patch for CVE-2025-57819 blocks new exploitation but does not clean systems that are already compromised.
CRIL recommends this order:
- Isolate the host from the internet.
- Preserve crontabs, logs, and the ampusers table.
- Remove the cron entries and the zen2 watchdog.
- Delete the eight crontab backups and the login stagers.
- Remove extra UID-0 accounts and accounts with $1$nRz1Cbtk$ password hashes.
- Delete the 12 webshell copies and the freepbxusers row.
- Only then, rotate credentials across all 17 files.
CRIL’s report-only beagle.sh script can help with triage. Because the operator keeps rotating hashes and hosts, detection based on behavior and file origin will outlast hunting for specific hashes.
