CTI · reviewed · 2026-09-09

INJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP Infrastructure

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence
• T1053 Scheduled Task/Job Execution
• T1037 Boot or Logon Initialization Scripts Persistence
• T1562 Impair Defenses Stealth

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 160.119.76.250 ipv4 · expired
• 187.108.1.130 ipv4 · expired
• 45.234.176.202 ipv4 · expired
• 45.95.147.178 ipv4 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: FreePBX JOMANGY Web Shell Persistence Artifacts
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects persistence artifacts associated with the INJ3CTOR3 JOMANGY PHP webshell campaign targeting FreePBX VoIP infrastructure, including aggressive cron jobs (1-3 minute intervals) and shell profile stagers.
references:
  - https://cyberpress.org/inj3ctor3-freepbx-jomangy-campaign/
  - https://cybertop.ai/t/cve-2025-64328-sangoma-freepbx-os-command-injection-vulnerability
author: Tia N. List
date: 2026/09/09
tags:
  - attack.t1053
  - attack.t1100
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/crontab'
    CommandLine|contains:
      - '*/1 *'
      - '*/2 *'
      - '*/3 *'
  selection2:
    Image|endswith: '/crontab'
    CommandLine|contains: '/var/spool/cron'
  condition: selection or selection2
falsepositives:
  - Legitimate high-frequency cron jobs on FreePBX systems
level: high

References

• https://cyberpress.org/inj3ctor3-freepbx-jomangy-campaign/
• https://cybertop.ai/t/cve-2025-64328-sangoma-freepbx-os-command-injection-vulnerability