INJ3CTOR3 malware steals FreePBX SIP credentials for phone fraud
Original title: Hackers Attack FreePBX Servers With Malware to Steal SIP Credentials for Phone Fraud
An updated installer uploads 17 configuration files every minute to two staging servers, Cyble reported on October 28.
Cyble Research & Intelligence Labs says the INJ3CTOR3 operation updated malware used against FreePBX phone servers so it steals SIP trunk passwords, database credentials, management secrets, and mail-relay logins. Stolen carrier credentials can place calls from another machine even after the PBX is rebuilt, unless the carrier limits source addresses. The installer, recovered from staging servers examined in September 2026, uploads 17 files to two servers and is scheduled every minute. JOMANGY and ZenharR webshells remain, watermarks and the password-gate hash changed, and a takeover script clears logs. Researchers did not capture live exfiltration or a victim count.
Unconfirmed: Cyble recovered upload commands but did not capture live exfiltration or establish how many victims were hit.
- Targeted files span FreePBX, Issabel, Elastix, Asterisk, and Postfix configurations.
- Changing passwords before removal can return the new secrets to the attacker.
- Cyble did not observe this campaign planting a hidden Asterisk trunk.
- Staging IPs listed are 45.95.147.178 and 160.119.69.4.
Impact: SIP, database, management, and mail credentials stolen for phone fraud
| Product | Affected |
|---|---|
| Sangoma FreePBX | — |
- 1.Isolate the server, remove persistence, then rotate trunk, extension, and account secrets.
- 2.Rebuild from a trusted image rather than relying on a normal-looking dashboard.
- 3.Ask carriers to replace trunk secrets, restrict source addresses, and set spending limits.
- ATT&CK
- T1505.003 Web ShellT1053.005 Scheduled TaskT1552.001 Credentials In FilesT1070 Indicator Removal
- Vendors
- Sangoma
- Organizations
- Cyble Research & Intelligence Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 160.119.69.4 | ntext IPv4 45[.]95[.]147[.]178 Original staging server IPv4 160[.]119[.]69[.]4 Additional staging server URL hxxp://45[.]95[.]147[.] |
| ipv4 | 45.95.147.178 | dicators of compromise (IoCs):- Type Indicator Context IPv4 45[.]95[.]147[.]178 Original staging server IPv4 160[.]119[.]69[.]4 Addit |
| md5 | 8b3a1d970fda0c17a0b785a990fb7b6a | 725ebaaadac217dfaa7ca8e8fe7e Additional-build watermark MD5 8b3a1d970fda0c17a0b785a990fb7b6a Webshell authentication gate Hash prefix $1$nRz1Cbtk$ Backd |
| sha256 | 1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9 | 8d6d7af640f59d7959903f838 Original-server installer SHA-256 1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9 Additional-server installer SHA-256 b54a8d9e98ff36dfe63b2ae |
| sha256 | 38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838 | 40410787cae135d1c4a248c07c0d Shared takeover script SHA-256 38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838 Original-server installer SHA-256 1c14a761620691a43b1a554a9 |
| sha256 | aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1 | 7311595bb4dd072850fed5900a0b Original-server wr.php SHA-256 aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1 Additional-server wr.php SHA-256 adeb015fdb37814edc3ed45230 |
| sha256 | adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c | 118abadd7aa4fc98923f01ffd1 Additional-server wr.php SHA-256 adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c Original JOMANGY build SHA-256 d345671e688ee807e1bb9b6fc45e |
| sha256 | b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b | 63945250d4f57b10d20fce9 Additional-server installer SHA-256 b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b Original-server wr.php SHA-256 aa6dfd7ee90d9aea5af29ae39c14 |
| sha256 | c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d | 9[.]69[.]4/hima_data/index.php Credential collector SHA-256 c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d Shared takeover script SHA-256 38edbfc4ac89619d2bdb3f4bb262 |
| sha256 | d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672 | bb195a5a7e4487c01549b47c744c Original JOMANGY build SHA-256 d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672 Additional JOMANGY build String trace_bd42a8a0d23ae16c85ded |
| url | http://160.119.69.4/hima_data/index.php | 95[.]147[.]178/hima_data/index.php Credential collector URL hxxp://160[.]119[.]69[.]4/hima_data/index.php Credential collector SHA-256 c6e64453ea8bc0856333b6f5 |
| url | http://45.95.147.178/hima_data/index.php | erver IPv4 160[.]119[.]69[.]4 Additional staging server URL hxxp://45[.]95[.]147[.]178/hima_data/index.php Credential collector URL hxxp://160[.]119[.]69[.]4/hi |
From the original article
3 min read at cybersecuritynews.com
Hackers targeting FreePBX phone servers have upgraded their malware to steal credentials that can keep phone fraud running even after an infected system is rebuilt. The INJ3CTOR3 operation now collects configuration files containing SIP trunk passwords, database credentials, management secrets, and mail relay logins, extending the damage beyond the compromised server. The change builds on […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.