SecurityOnlineDo Son
INJ3CTOR3 malware steals FreePBX credentials for toll fraud
Part of the CVE-2019-19006 story · since 3 Feb
- Tue 3 Feb, 21:45 UTC. Security Affairs, first report. U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
- Wed 4 Feb, 10:16 UTC. SecurityWeek, its first report on the story. Fresh SolarWinds Vulnerability Exploited in Attacks. Cites a CVE in CISA KEV.
- Fri 30 Oct, 09:00 UTC. SecurityOnline, its first report on the story. INJ3CTOR3 malware steals FreePBX credentials for toll fraud. Cites a CVE in CISA KEV. This article, 3rd of 3.
Cyble researchers report a renewed INJ3CTOR3 wave targeting Asterisk-based FreePBX, Issabel and Elastix telephony appliances. The campaign leverages internet-facing PBX management panels and exploits vulnerabilities such as CVE-2019-19006 and CVE-2025-57819 to gain initial access, with Shadowserver telemetry noting more than 900 FreePBX servers compromised in February 2026 and over 700 still infected by May 2026.
The operator, tracked as INJ3CTOR3 and linked to toll-fraud activity dating to 2020, uses a takeover script that expands from 367 lines in April 2026 to 620 lines by September 2026, enabling exclusive control by deleting rival web shells, removing SSH keys, and locking rival command servers.
The malware—dubbed INJ3CTOR3 FreePBX malware (including JOMANGY and ZenharR PHP webshells), a /x Bash takeover script, and a k.php credential uploader—exfiltrates 17 configuration files every 60 seconds. The stolen data includes SIP trunk secrets, Asterisk Manager Interface credentials, MySQL passwords, Issabel/Elastix settings, and Postfix mail-relay logins, allowing off-box toll fraud even after cleaning.
Defenders are instructed to rotate all 17 credential sets and rebuild systems from clean images, as the six persistence layers reconstruct within minutes. The attackers inject rogue SIP trunks directly into disk-based Asterisk configurations, bypassing the FreePBX web GUI. Cyble cites Cyble’s own report and emphasises the risk of the trunk credentials being usable across carriers if not IP-restricted. Attribution ties September 2026 staging artefacts to INJ3CTOR3, including the hima_data upload path linked to a 2020 Telegram user named Hima.
How the story developed
3 articles from 3 outlets since 3 Feb. Picked up again today after 38 weeks quiet. This was the 3rd report, 268 days after the first.
- Tue 3 Feb, 21:45 UTC. Security Affairs, first report. U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
- Wed 4 Feb, 10:16 UTC. SecurityWeek, its first report on the story. Fresh SolarWinds Vulnerability Exploited in Attacks. Cites a CVE in CISA KEV.
- Fri 30 Oct, 09:00 UTC. SecurityOnline, its first report on the story. INJ3CTOR3 malware steals FreePBX credentials for toll fraud. Cites a CVE in CISA KEV. This article, 3rd of 3.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 3 articles as a listHide the list
- Tue 3 FebDay 01
- U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalog21:45 · Security Affairs · First report · Exploited CVE · Known exploited CVE
- Wed 4 FebDay 11
Quiet for 38 weeks
Fri 30 OctDay 2691- INJ3CTOR3 malware steals FreePBX credentials for toll fraud09:00 · SecurityOnline · Picked up again · Known exploited CVE · This article, 3rd of 3