EN PT-BR
← Voltar ao feed
high telecommunications

INJ3CTOR3 adds credential theft to FreePBX toll-fraud campaign, enabling call fraud after server cleanup

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 03:52 · coletado há 3 dias

INJ3CTOR3 has expanded its FreePBX toll-fraud campaign with automated credential theft. Attackers can keep billing unauthorized calls even after infected servers are cleaned. September 2026 artifacts from Cyble show an updated k.php installer that targets 17 configuration files holding telephony, database, management and mail-relay secrets. Stolen SIP trunk credentials may let operators authenticate directly to carriers from external infrastructure, unless providers enforce source-IP restrictions. Researchers recovered upload commands but did not capture live exfiltration or a victim list, so the findings show collection capability, not a confirmed count of stolen accounts.

Detalhes técnicos

  • The k.php installer contains two base64-encoded command sequences. Each issues 17 curl uploads to /hima_data/index.php on separate staging servers.
  • Three cron beacons run the installer every minute, repeatedly exporting configuration files.
  • Targets span FreePBX, Issabel and Elastix layouts: SIP/PJSIP configuration, manager.conf (Asterisk Manager Interface credentials), platform configuration with database passwords, and Postfix sasl_passwd.
  • Plain-text download commands reference 160[.]119[.]69[.]4, while encoded persistence commands retain 45[.]95[.]147[.]178. Credential uploads target both, so reviewing only readable cron entries misses surviving paths.
  • The JOMANGY panel is largely unchanged, but build-specific watermarks replace the previously shared identifier. JOMANGY and ZenharR share a rotated MD5 authentication gate, which weakens detection based only on earlier indicators.
  • The installer writes an Apache .htaccess rule routing whitespace-prefixed requests to config.php. Access logs record the requested URI, not the executing filename.
  • The panel can create a privileged FreePBX session through the ampuser class and setAdmin(), so an administrator password reset does not neutralize that path.
  • Lab testing showed trunks written directly into Asterisk configuration can operate without appearing in the FreePBX console. This was not observed in this campaign; it is a visibility gap.
  • Cyble's May JOMANGY research documented six reinforcing persistence channels (cron polling, shell-profile injection, immutable backups, watchdogs, protected webshell copies, a PHP executor).
  • Background: Check Point (2020) linked INJ3CTOR3 to CVE-2019-19006 exploitation; Unit 42 documented related Elastix and ZenharR activity; Fortinet analyzed EncystPHP in January 2026.

Remediação

  • Isolate affected systems, block both staging addresses, and investigate outbound HTTP POSTs to /hima_data/.
  • Rebuild, or comprehensively remove all persistence, before rotating secrets; otherwise replacement secrets are collected too. Include carrier-side trunk credentials.
  • Monitor carriers for unfamiliar registration addresses, premium-rate destinations, unusual concurrency and abnormal spending.
  • Compare Asterisk active endpoints and registrations against FreePBX records and inspect custom configuration directly.

Linha do tempo

  1. gbhackers.com ↗ · pub. 29/10/2026 03:52 · coletado 29/10 05:00 primeiro registro

    INJ3CTOR3 adds credential theft to FreePBX toll-fraud campaign, enabling call fraud after server cleanup

    ler a análise desta fonte

    INJ3CTOR3 has expanded its FreePBX toll-fraud campaign with automated credential theft. Attackers can keep billing unauthorized calls even after infected servers are cleaned. September 2026 artifacts from Cyble show an updated k.php installer that targets 17 configuration files holding telephony, database, management and mail-relay secrets. Stolen SIP trunk credentials may let operators authenticate directly to carriers from external infrastructure, unless providers enforce source-IP restrictions. Researchers recovered upload commands but did not capture live exfiltration or a victim list, so the findings show collection capability, not a confirmed count of stolen accounts.

    Technical Details

    • The k.php installer contains two base64-encoded command sequences. Each issues 17 curl uploads to /hima_data/index.php on separate staging servers.
    • Three cron beacons run the installer every minute, repeatedly exporting configuration files.
    • Targets span FreePBX, Issabel and Elastix layouts: SIP/PJSIP configuration, manager.conf (Asterisk Manager Interface credentials), platform configuration with database passwords, and Postfix sasl_passwd.
    • Plain-text download commands reference 160[.]119[.]69[.]4, while encoded persistence commands retain 45[.]95[.]147[.]178. Credential uploads target both, so reviewing only readable cron entries misses surviving paths.
    • The JOMANGY panel is largely unchanged, but build-specific watermarks replace the previously shared identifier. JOMANGY and ZenharR share a rotated MD5 authentication gate, which weakens detection based only on earlier indicators.
    • The installer writes an Apache .htaccess rule routing whitespace-prefixed requests to config.php. Access logs record the requested URI, not the executing filename.
    • The panel can create a privileged FreePBX session through the ampuser class and setAdmin(), so an administrator password reset does not neutralize that path.
    • Lab testing showed trunks written directly into Asterisk configuration can operate without appearing in the FreePBX console. This was not observed in this campaign; it is a visibility gap.
    • Cyble's May JOMANGY research documented six reinforcing persistence channels (cron polling, shell-profile injection, immutable backups, watchdogs, protected webshell copies, a PHP executor).
    • Background: Check Point (2020) linked INJ3CTOR3 to CVE-2019-19006 exploitation; Unit 42 documented related Elastix and ZenharR activity; Fortinet analyzed EncystPHP in January 2026.

    Remediation

    • Isolate affected systems, block both staging addresses, and investigate outbound HTTP POSTs to /hima_data/.
    • Rebuild, or comprehensively remove all persistence, before rotating secrets; otherwise replacement secrets are collected too. Include carrier-side trunk credentials.
    • Monitor carriers for unfamiliar registration addresses, premium-rate destinations, unusual concurrency and abnormal spending.
    • Compare Asterisk active endpoints and registrations against FreePBX records and inspect custom configuration directly.