INJ3CTOR3 FreePBX implant now steals SIP trunk and admin credentials
Original title: From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves
Cleaning the host no longer ends exposure: stolen trunk secrets let the operator place calls from anywhere.
Cyble says September artifacts from INJ3CTOR3 staging servers show the FreePBX installer now uploads victim SIP trunk, AMI, database, and mail-relay credentials on every run. The k.php script sends 17 configuration files to two staging hosts about once a minute while the host stays infected. The webshell, encoding, and persistence are largely unchanged, but watermarks and the gate hash were rotated. FreePBX, Issabel, and Elastix operators who suspect compromise must rotate those secrets only after the host is clean.
Unconfirmed: The credential-theft change is based on Cyble’s mid-September collection from the operator’s staging servers.
- Uploads go to /hima_data/index.php on 45.95.147.178 and 160.119.69.4.
- The webshell gate hash is now 8b3a1d970fda0c17a0b785a990fb7b6a.
- The /x takeover script grew from 367 lines to 620, mostly cleanup of rivals.
- Trunks written directly under /etc/asterisk do not appear in the FreePBX console.
- A carrier IP restriction is needed so a stolen trunk cannot register from elsewhere.
Impact: SIP trunk, AMI, database, and mail credentials stolen
| Product | Affected |
|---|---|
| Sangoma FreePBX | — |
| Issabel | — |
| Elastix | — |
- 1.Rotate secrets in the 17 configuration files only after the host is clean.
- 2.Do not rotate credentials while the implant is still running.
- 3.Ask the carrier to restrict the SIP trunk to the organization’s IP addresses.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 160.119.69.4 | otated. Two staging hosts. Plain-text commands now point to 160[.]119[.]69[.]4, while base64-encoded ones still use 45[.]95[.]147[.] |
| ipv4 | 160.119.76.250 | appears deliberate. This host is distinct from the scanner 160[.]119[.]76[.]250, which is named in our May report. Defend: block both |
| ipv4 | 45.95.147.178 | 7 files to /hima_data/index.php on both hosts Staging hosts 45[.]95[.]147[.]178 45[.]95[.]147[.]178 and 160[.]119[.]69[.]4 webshell w |
| md5 | 8b3a1d970fda0c17a0b785a990fb7b6a | hash (JOMANGY and ZenharR) a2f6863413c4192a4abfa360577b9961 8b3a1d970fda0c17a0b785a990fb7b6a /x takeover script 367 lines 620 lines, mostly added cleanu |
| md5 | a2f6863413c4192a4abfa360577b9961 | nt value per build Webshell gate hash (JOMANGY and ZenharR) a2f6863413c4192a4abfa360577b9961 8b3a1d970fda0c17a0b785a990fb7b6a /x takeover script 367 lin |
| sha256 | 1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9 | 8d6d7af640f59d7959903f838 SHA256 k.php, 45[.]95[.]147[.]178 1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9 SHA256 k.php, 160[.]119[.]69[.]4 b54a8d9e98ff36dfe63b2aea97 |
| sha256 | 38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838 | 48c07c0d SHA256 /x takeover script, identical on both hosts 38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838 SHA256 k.php, 45[.]95[.]147[.]178 1c14a761620691a43b1a554a9 |
| sha256 | aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1 | 595bb4dd072850fed5900a0b SHA256 wr.php, 45[.]95[.]147[.]178 aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1 SHA256 wr.php, 160[.]119[.]69[.]4 adeb015fdb37814edc3ed4523 |
| sha256 | adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c | 18abadd7aa4fc98923f01ffd1 SHA256 wr.php, 160[.]119[.]69[.]4 adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c SHA256 JOMANGY webshell on disk, 45[.]95[.]147[.]178… |
| sha256 | b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b | 59463945250d4f57b10d20fce9 SHA256 k.php, 160[.]119[.]69[.]4 b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b SHA256 wr.php, 45[.]95[.]147[.]178 aa6dfd7ee90d9aea5af29ae3 |
| sha256 | c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d | .]69[.]4/hima_data/index.php URL Credential upload endpoint c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d SHA256 /x takeover script, identical on both hosts 38edbfc4 |
| url | http://160.119.69.4/hima_data/index.php | 47[.]178/hima_data/index.php URL Credential upload endpoint hxxp://160[.]119[.]69[.]4/hima_data/index.php URL Credential upload endpoint c6e64453ea8bc0856333b6 |
| url | http://45.95.147.178/hima_data/index.php | [.]4 IPv4 Second staging host and credential collector, new hxxp://45[.]95[.]147[.]178/hima_data/index.php URL Credential upload endpoint hxxp://160[.]119[.]69[ |
From the original article
13 min read at cyble.com
Executive Summary In May, Cyble Research & Intelligence Labs (CRIL) documented JOMANGY, a PHP webshell generation deployed by INJ3CTOR3 with self-healing persistence channels and a built-in toll-fraud dialer. Back then, the fraud ran through the victim's own PBX, so removing the implant would have stopped it.
By rohansinhacyblecom · cyble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.