FreePBX

Search everything

Mentions · 7d3
Mentions · 30d3
All mentions5
First seenAug 17, 2026
Last mentioned3d ago

Timeline

5 articles · newest first

INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud

An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.

Cyber Security NewsOct 29, 11:09 UTC · 3d agoMalware 3 sources3

INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup

A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.

GBHackersupdated Oct 29, 11:09 UTC · 3d agofirst Oct 29, 06:52 UTC · 3d agoMalware 3 sources2

INJ3CTOR3 FreePBX implant now steals SIP trunk and admin credentials

Cleaning the host no longer ends exposure: stolen trunk secrets let the operator place calls from anywhere.

Cybleupdated Oct 29, 11:09 UTC · 3d agofirst Oct 28, 05:02 UTC · 4d agoThreat actor 3 sources1

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

Exploit-DB published a remote code execution exploit targeting FreePBX version 17.0.2.

Exploit-DBSep 3, 00:00 UTC · Sep 3, 2026Exploit / PoC3

Mirai Variant V3G4 Targets IoT Devices

Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.

Palo Alto Unit 42Aug 17, 13:05 UTC · Aug 17, 2026MalwareExploitedCVE-2012-4869 CVE-2014-9727 CVE-2017-5173+63 · 2 reads

Related CVEs

by mentions

CVE-2020-1541584%9.8
Unauthenticated OS Command Injection in DrayTek Vigor3900/2960/300B Routers
published Jun 30, 2020DrayTek Vigor3900KEVPoC
CVE-2022-26134100%9.8
Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
published Jun 3, 2022Atlassian Confluence ServerKEVRansomwarePoC ×2
CVE-2020-8515100%9.8
Unauthenticated Command Injection RCE in DrayTek Vigor3900/2960/300B Routers
published Feb 1, 2020DrayTek Vigor3900KEVPoC
CVE-2019-15107100%9.8
Unauthenticated Command Injection RCE in Webmin <= 1.920
published Aug 16, 2019WebminKEVRansomwarePoC ×5
CVE-2017-517330%9.8
An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12
published May 19, 2017geutebrueck ip camera g-cam efd-2250 firmwarePoC
CVE-2022-3626754%9.8
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability
published Aug 8, 2022airspan airspot 5410 firmwarePoC ×2
CVE-2022-425744%9.8
C-DATA Web Management System: It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET…
published Dec 1, 2022cdatatec c-data web management systemPoC
CVE-2012-486970%—
published —
CVE-2014-972772%—
published —

Appears with

Issabelproduct · 3
Elastixproduct · 3
JOMANGYmalware · 3
Asteriskproduct · 2
ZenharRmalware · 2
Postfixproduct · 2
Sangomavendor · 2
Unit 42organization · 2
INJ3CTOR3malware · 2
Cybleorganization · 2
Webminvendor · 1
Palo Alto Networksorganization · 1
EncystPHPmalware · 1
Miraimalware · 1
INJ3CTOR3threat actor · 1
Atlassianvendor · 1

Entities are extracted by the model from each article. First seen Aug 17, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.