Threat reportThreat IntelligenceTL-2026-4259
The 5060 Siege: Industrialized SIP Brute-Force and Toll-Fraud Campaign Against Telephony Infrastructure
The 5060 Siege (TL-2026-4259), also tracked as The 5060 Siege, is a high-severity tracked intrusion set, first published 2026-10-23. It has no confirmed attribution, affects FreePBX / Sangoma FreePBX (SIP/PBX), maps to 9 MITRE ATT&CK techniques (T1036, T1110, T1110.001), and is covered by 9 detection rules and 5 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 5Indicators of compromise
Key facts for TL-2026-4259
- Threat ID
- TL-2026-4259
- Also known as
- The 5060 Siege
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- telecoms, enterprise, voip-providers, managed-service-providers
- Target regions
- Global, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in The 5060 Siege
Malware and tooling: Mevade
How The 5060 Siege works
CloudSEK honeypot telemetry recorded 15,183,358 SIP events from 323 source addresses over an 18-day window (4-22 May 2026), dominated by registration brute force (1,869,521 Digest authentication attempts across 29,433 extensions) and 89,465 toll-fraud INVITE attempts aimed mainly at UK revenue-share ranges. 99.8% of source-attributed traffic came from datacenter/hosting ranges, chiefly OVH (AS16276).
CloudSEK researcher Vikas Kundu published 'THE 5060 SIEGE' on 2026-06-23, documenting a sustained, automated assault on the SIP telephony ecosystem observed through honeypots. The window covered 18 days (reported as 4-22 May 2026) and produced 15,183,358 telemetry events, of which 3,787,791 were distinct SIP requests from 323 unique source addresses.
The dominant activity was credential harvesting through SIP REGISTER brute force: 1,869,521 authentication attempts carrying full Digest credentials were spread across 29,433 distinct extension identities. Because the captured authentication material was complete, CloudSEK determined the plaintext password behind 96.09% of all attempts, yielding a dictionary of 277,632 unique passwords and 1,499,846 unique extension/password pairs. CloudSEK characterizes this as curated-dictionary credential harvesting rather than opportunistic guessing. Every authentication against the honeypots was rejected, so the value of the dataset is intelligence on adversary wordlists, target numbers, tooling and infrastructure rather than observed compromise.
A second activity stream was toll fraud: 89,465 INVITE (call-setup) attempts, 47,273 of them toward UK numbers, concentrated on rural and Northern Ireland ranges consistent with International Revenue Share Fraud (IRSF). Authenticated access to a real PBX would let the operator place such calls at the victim's expense.
The scanners impersonated common telephony platforms through spoofed User-Agent values (FreePBX, Cisco, Polycom, Avaya) and reused a hardcoded Contact header signature present in 3,396,685 registration requests (the value is redacted in the published text). Infrastructure was cheap and European and highly concentrated: OVH (AS16276) originated 6,559,589 events, and a single /24 (15.204.157.0/24) produced 5,178,084 events alone. 93.5% of attacker addresses already appeared on known-abuser lists. No CVE is involved and the source names no threat actor; severity is analyst-assigned based on scale and the credential-theft and financial-fraud impact on exposed PBX/VoIP deployments.
MITRE ATT&CK techniques used in TL-2026-4259
Defense Evasion
Credential Access
T1110 Brute Force; T1110.001 Password Guessing; T1110.003 Password Spraying
Impact
T1496 Resource Hijacking; T1657 Financial Theft
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning
Affected products and versions in The 5060 Siege
- FreePBX / Sangoma — FreePBX (SIP/PBX)
Vulnerable versions: Internet-exposed SIP with weak extension credentials - Cisco — SIP telephony endpoints/PBX (impersonated User-Agent targeted)
Vulnerable versions: Internet-exposed SIP with weak extension credentials - Polycom — SIP phones (impersonated User-Agent targeted)
Vulnerable versions: Internet-exposed SIP with weak extension credentials - Avaya — SIP telephony (impersonated User-Agent targeted)
Vulnerable versions: Internet-exposed SIP with weak extension credentials
Remediation for The 5060 Siege
Immediate actions
- Block or rate-limit SIP (5060/UDP/TCP/TLS) traffic from 15.204.157.0/24 and from OVH AS16276 sources where there is no business need
- Do not expose SIP signaling to the internet; restrict to carrier/trunk and known endpoint IP allow-lists
- Alert on bursts of SIP 401/403 responses and REGISTER failures across many extensions from one source
- Review CDRs for outbound calls to UK rural/Northern Ireland and other premium or revenue-share ranges
Workarounds
- Use SIP over TLS with SRTP and restrict signaling by firewall/SBC
- Place PBX behind a VPN for remote extensions
Longer-term hardening
- Enforce strong unique SIP passwords and disable extensions that do not need remote registration
- Deploy fail2ban or an SBC with registration rate limiting and automatic IP banning
- Set outbound call restrictions, per-extension spend limits and international dialing allow-lists
- Ingest SIP/PBX authentication logs into the SIEM and correlate with threat-intel abuse lists
Weaknesses (CWE) in The 5060 Siege
Timeline of The 5060 Siege
- Start of the 18-day CloudSEK SIP honeypot observation window; sustained automated SIP scanning and registration brute force recorded from this point.
- Concentrated high-tempo activity begins (5-day burst 8-12 May) within the observation window, per CloudSEK.
- End of the 8-12 May high-tempo burst; scanning continued at lower rate until the window closed.
- Cumulative over the window: 89,465 INVITE toll-fraud attempts, 47,273 toward UK numbers (rural and Northern Ireland ranges consistent with IRSF).
- Cumulative over the window: 1,869,521 Digest authentication attempts across 29,433 extensions; plaintext recovered for 96.09% of attempts (277,632 unique passwords, 1,499,846 extension/password pairs). All authentications were rejected.
- End of the observation window with 15,183,358 telemetry events, including 3,787,791 distinct SIP requests from 323 unique source addresses.
- CloudSEK publishes 'THE 5060 SIEGE' (Vikas Kundu), disclosing OVH AS16276 (6,559,589 events) and 15.204.157.0/24 (5,178,084 events) as primary source infrastructure.
Sources cited for The 5060 Siege
- THE 5060 SIEGE - Industrialized Attacks Against the SIP Telephony Ecosystem (CloudSEK, Vikas Kundu)
- CloudSEK SIP Honeypot Report (PDF)
- CloudSEK blog (Arabic edition) - The 5060 Siege
- OffSeq Mirage - The Honeypot That Gets Robbed (independent SIP toll-fraud study, 21 Jun-19 Aug 2026; corroborating, separate dataset)
- MITRE ATT&CK T1110 Brute Force
- MITRE ATT&CK T1657 Financial Theft
Detection coverage for TL-2026-4259
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4259 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.