Reported by 6 outlets
INJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP Infrastructure
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.16 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Cyble documented the JOMANGY campaign on May 21, 2026 as the newest INJ3CTOR3 generation against internet-exposed FreePBX, delivered by a multi-stage Bash dropper that carries live toll fraud code placing calls through the victim's own SIP trunks via asterisk -rx "channel originate Local/@". No exploit payload was recovered, so the entry vector is assessed rather than confirmed, with two candidates: CVE-2025-57819, the pre-auth authentication bypass and SQL injection in the endpoint module of FreePBX 15, 16, and 17 scored Critical 10.0 and patched in endpoint 15.0.66, 16.0.89, and 17.0.3, and CVE-2025-64328, post-auth command injection in the filestore module 17.0.2.36 through below 17.0.3 scored 8.6 and fixed in 17.0.3. Both sit on the CISA KEV catalog, added 2025-08-29 and 2026-02-03 respectively.
The argument a defender needs is that partial remediation is useless by design. Six independent channels, cron C2 polling every one to three minutes, shell profile injection, immutable crontab backups, a process watchdog, chattr +i-protected webshell copies, and a self-reinstalling PHP executor, each rebuild the full infection from any single survivor within minutes, backed by 18 accounts across three tiers where nine are UID-0. The host is a defended asset: the dropper evicts 50-plus rival webshell signatures, blocks 11 competitor C2 IPs, and deletes INJ3CTOR3's own January 2026 EncystPHP artifacts, so a box cleaned of the last generation can already carry this one. The scale is documented, not hypothetical: the C2 inventory people2.txt lists 3,080 addresses with roughly 39 percent on Alibaba Cloud, Shadowserver counted about 900 CVE-2025-64328-compromised instances beginning December 2025, and internet-exposed FreePBX panels number in the tens of thousands with many on end-of-life releases. The victim pays a carrier bill for premium-rate traffic rather than a ransom, and this operator has monetized the same surface since 2019 across CVE-2019-19006, ZenharR on CVE-2021-45461, EncystPHP, and now JOMANGY.
Patch the endpoint module to 15.0.66, 16.0.89, or 17.0.3 and filestore to 17.0.3 with fwconsole ma upgradeall, then restrict the Administrator Control Panel with the FreePBX Firewall module so the Internet zone cannot reach web management. Hunt exactly what the advisories and reports name: zgrep modular.php across /var/log/httpd and /var/log/apache2 access logs back to August 21, 2025, ls -l /var/www/html/.clean.sh, grep 9998 /var/log/asterisk/full, SELECT * FROM ampusers, integrity of /etc/freepbx.conf, the newfpbx UID-0 account, license.php under /var/www/html/admin/modules/freepbx_ha/, cron entries writing /var/lib/asterisk/bin/devnull, the whitespace-rewrite .htaccess in /var/www/html/admin/views/, inbound GETs to /admin/modules/phones/ajax.php?md5= or /restapps/applications.php, and Apache log lines missing the string restapps. Then rotate SIP trunk, portal, and system passwords and reconcile CDRs against the carrier invoice for international calls nobody placed.
Two developments would change the assessment. Confirmation of the true entry vector, since the current attribution rests on the restapps log scrub and the deletion of -watchTowr-.php PoC artifacts and could still land on a different FreePBX flaw. And evidence of another infrastructure rotation, following the migration from Brazilian to Dutch hosting between the EncystPHP and JOMANGY generations, with SANS observing April 2026 probes from 160.119.76.250 in the Netherlands. Any new FreePBX advisory touching the web stack, or a KEV entry for a third FreePBX CVE, moves the deadline for the remaining exposed estate.
Timeline
-
original reporting
INJ3CTOR3's FreePBX JOMANGY Campaign — Six-Layer Self-Healing Persistence on VoIP Infrastructure
cyberpress.org · 145d ago · May 22nd, 2026
Cyble Research & Intelligence Labs (CRIL) documented a campaign from INJ3CTOR3 deploying the previously unknown JOMANGY PHP webshell family against FreePBX VoIP infrastructure. The campaign exhibits a six-layer persistence architecture designed to self-heal within minutes from any single surviving channel — including recurring cron polling (every 1–3 minutes), shell profile stagers, and aggressive competitor eviction (scrubbing 50+ rival webshell signatures, blocking 11 rival C2 IPs). An inventory of 3,080 C2 IP addresses was observed, with ~39% on Alibaba Cloud infrastructure. The primary candidates for initial access are CVE-2025-64328 (post-auth command injection) and CVE-2025-57819 (pre-auth SQL injection).
-
update from freepbx.org
Security Advisory: Please Lock Down Your Administrator Access
freepbx.org · 413d ago · August 26th, 2025
The Sangoma FreePBX security team opened this advisory thread on August 26, 2025 after exploitation of internet-exposed administrator panels was detected, shipping an EDGE endpoint fix the same day and the stable fix on August 28. It publishes the infection checklist still referenced months later: POST requests to modular.php in Apache access logs reaching back to August 21, the leftover /var/www/html/.clean.sh file, calls to extension 9998 in Asterisk logs, unknown rows in the ampusers table, and restricting the Administrator Control Panel with the Firewall module.
-
update from github.com
Authentication Bypass Leading to SQL Injection and RCE (GHSA-m42g-xg4c-5f3h, CVE-2025-57819)
github.com · 412d ago · August 28th, 2025
The official FreePBX advisory for CVE-2025-57819, published August 28, 2025: insufficiently sanitized user-supplied input in the commercial endpoint module allows unauthenticated access to the FreePBX Administrator, arbitrary database manipulation, and remote code execution across FreePBX 15, 16, and 17, patched in endpoint 15.0.66, 16.0.89, and 17.0.3. The vendor states attacks began on or before August 21, 2025 against systems with the admin panel exposed to the internet, scoring the flaw Critical 10.0 under CVSS v4.
-
update from github.com
watchTowr-vs-FreePBX-CVE-2025-57819 (public PoC and detection artifact generator)
github.com · 400d ago · September 8th, 2025
watchTowr Labs published a working exploit for CVE-2025-57819 on September 8, 2025, chaining the auth bypass through SQL injection to webshell upload and root-level access, with a fallback that adds a rogue administrator user. Public weaponization one week after the vendor fix matters for this story because the JOMANGY webshell cleanup routine deletes files matching -watchTowr-.php, tying the campaign to artifacts from this exact release.
-
update from fortinet.com
Unveiling the Weaponized Web Shell EncystPHP
fortinet.com · 259d ago · January 28th, 2026
FortiGuard Labs documents EncystPHP, a persistent FreePBX webshell delivered via CVE-2025-64328 in incidents starting early December 2025, and attributes the activity to INJ3CTOR3, an actor targeting VoIP infrastructure since 2019 via CVE-2019-19006 and later CVE-2021-45461. The report details the newfpbx UID-0 backdoor account, crontab entries re-downloading k.php droppers at one to three minute intervals, webshell copies masquerading as ajax.php across /var/www/html subdirectories, and dropper infrastructure at 45.234.176.202 and 187.108.1.130.
-
update from sans.edu
Scans for EncystPHP Webshell (SANS ISC diary 32892)
sans.edu · 183d ago · April 13th, 2026
SANS ISC recorded live scanning for the EncystPHP webshell on FreePBX systems on April 13, 2026: GET requests to /admin/modules/phones/ajax.php carrying the webshell's hardcoded md5 credential, and /restapps/applications.php exploit requests that download k.php from 45.95.147.178 and reset passwords on ten accounts including root, asterisk, and freepbxuser. The probes originated from 160.119.76.250 in the Netherlands, which also swept for other FreePBX vulnerabilities.
-
update from cyble.com
JOMANGY: INJ3CTOR3's Self-Healing FreePBX Toll Fraud Campaign
cyble.com · 145d ago · May 21st, 2026
Cyble Research & Intelligence Labs' original disclosure, one day before the Cyberpress coverage in this story: a multi-stage Bash dropper deploys the previously undocumented JOMANGY PHP webshell with six mutually protecting persistence channels, 18 backdoor accounts of which nine are UID-0, and live toll fraud code routing calls through the victim's SIP trunks. The report assesses CVE-2025-57819 and CVE-2025-64328 as the likely entry vectors, catalogs a 3,080-IP C2 inventory in people2.txt with roughly 39 percent on Alibaba Cloud, and documents eviction of 50-plus rival webshell signatures and blocking of 11 competitor C2 IPs.