JOMANGY: INJ3CTOR3 Self-Healing FreePBX Toll Fraud Campaign (CVE-2025-64328) — Threadlinqs Intelligence
As of 2026-05-30, JOMANGY: INJ3CTOR3 Self-Healing FreePBX Toll Fraud Campaign (CVE-2025-64328) is a high-severity malware threat attributed to INJ3CTOR3 (Palestinian Territories (Gaza)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0550 · Severity: HIGH · CVSS: 8.6 · Status: ACTIVE · Category: MALWARE
Attribution: INJ3CTOR3 · Palestinian Territories (Gaza) · FINANCIAL
INJ3CTOR3 — a Gaza-based financially motivated actor active since 2020 — has compromised 900+ Sangoma FreePBX instances since early December 2025 by exploiting CVE-2025-64328, a post-authentication OS
## Overview
TL-2026-0550 tracks an ongoing financially motivated intrusion campaign — internally dubbed JOMANGY by some responders — in which the long-running INJ3CTOR3 crew is exploiting CVE-2025-64328 to mass-compromise internet-facing Sangoma FreePBX PBX servers. As of late February 2026, multiple vendors (The Hacker News, SecPod, Fortinet FortiGuard Labs) corroborate that more than 900 live FreePBX instances have been backdoored since early December 2025. Sangoma published a patch in FreePBX 17.0.3 on 2025-11-07, and CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-02-03 with a federal remediation deadline of 2026-02-24, but a large unpatched population remains exposed.
## Vulnerability — CVE-2025-64328
CVE-2025-64328 (CWE-78, OS Command Injection) lives in the filestore module that ships with the FreePBX Endpoint Manager (commercial module, very widely installed). Specifically, the SSH driver's `testconnection.php` calls `check_ssh_connect()` and concatenates attacker-controllable connection parameters into a shell command without adequate sanitization. Because the vulnerable endpoint is reachable from the Administrative interface, an authenticated user with access to Endpoint Manager — including any account whose session can be forged or stolen from a previously breached host — can invoke the SSH connection-test feature with a crafted host/port/key payload and obtain command execution as the `asterisk` user. CVSS 4.0 scores the bug 8.6 HIGH (CVSS 3.1 base 7.2) and the vendor advisory is GHSA-vm9p-46mv-5xvw. Affected range: FreePBX Endpoint Manager filestore module versions 17.0.2.36 up to but not including 17.0.3. The fix is in 17.0.3.
## Exploit Chain
1. Initial Access — INJ3CTOR3 scans for internet-exposed FreePBX Administrative interfaces and either reuses harvested credentials, leverages default/weak admin accounts left exposed by integrators, or chains through unpatched authentication weaknesses to obtain a valid session cookie. Many victims are managed-service-provider hosted PBX systems with predictable admin URLs.
2. Vulnerability Trigger — The attacker browses to the Endpoint Manager and submits a POST request to the filestore SSH test endpoint with shell metacharacters embedded in the host or key arguments. The vulnerable `check_ssh_connect()` builds a shell command from these fields and executes it, yielding RCE as `asterisk`.
3. Payload Delivery — The initial command writes a small PHP dropper (k.php) to disk, typically into `/var/www/html/admin/modules/`, and then fetches the EncystPHP web shell payload from operator infrastructure. EncystPHP is dropped under multiple legitimate-looking names — most commonly `ajax.php` — into several FreePBX phone-module web roots: `/var/www/html/digium_phones/`, `/var/www/html/rest_phones/`, `/var/www/html/phones/`, and `/var/www/html/freepbxphones/`. The multiple copies are deliberate redundancy.
4. Persistence (Self-Healing) — A crontab entry is added for the asterisk or root user that runs every minute and `wget`/`curl`s k.php (or directly the EncystPHP body) from operator infrastructure, rewriting the web shell files if defenders delete them. A small `/var/www/html/.clean.sh` cleanup script removes telltale logs. This crontab + remote redeploy pattern is the campaign's signature 'self-healing' behaviour and is the reason most observed victims keep re-infecting after naïve cleanups.
5. Command and Control / Operator Interaction — Operators interact with EncystPHP via HTTP POST requests to `modular.php` (and to the ajax.php-named copies) carrying base64-encoded, sometimes XOR-obfuscated, command payloads. The shell supports file upload/download, arbitrary PHP/shell execution, and direct invocation of Asterisk Manager Interface (AMI) commands and dialplan originations.
6. Monetization (Impact) — The actor uses Asterisk dialplan abuse and AMI-originated calls to place outbound calls to attacker-controlled premium-rate / international-premium nu
Target sectors: telecommunications, managed service providers, small and medium business, hospitality, healthcare, education, government
Target regions: United States, Brazil, Canada, Germany, France, United Kingdom, Italy, Spain, Mexico, Australia
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2025-64328, T1595, T1592, T1583, T1587, T1190, T1078, T1059, T1059, T1505, T1053