INJ3CTOR3 Campaign Targets FreePBX Servers with JOMANGY/ZenharR Webshells to Steal SIP Credentials for Phone Fraud

Key facts for JOMANGY FreePBX webshell

Detection coverage for JOMANGY FreePBX webshell

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4735 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: INJ3CTOR3 JOMANGY/ZenharR Web-Tier Shell Spawn and Staging Dropper Fetch (SPL)

Behaviour-first search for the INJ3CTOR3 Bash dropper and PHP webshell execution on FreePBX/Issabel/Elastix/Asterisk hosts: web server or PHP processes spawning shells, curl/wget piped into a shell, and any command line touching staging servers 45.95.147.178 and 160.119.69.4, the /hima_data/ collector, wr.php or .clean.sh.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.004, T1505.003
• Data sources: sysmon_for_linux, linux_process_creation, index=linux sourcetype=sysmon:linux
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/php")
| eval web_parent=if(match(ParentImage,"/(httpd|apache2|php-fpm[0-9.]*|php-cgi|php)$"),1,0)
| eval staging_hit=if(match(CommandLine,"45[.]95[.]147[.]178|160[.]119[.]69[.]4|hima_data|/wr[.]php|/[.]clean[.]sh"),1,0)
| eval pipe_to_shell=if(match(CommandLine,"(curl|wget)[^|]*[|][ ]*(ba|da)?sh"),1,0)
| where staging_hit=1 OR pipe_to_shell=1 OR (web_parent=1 AND match(Image,"/(sh|bash|dash)$"))
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parents values(CommandLine) as commands max(staging_hit) as staging_hit by host User
| convert ctime(first_seen) ctime(last_seen)
| sort -staging_hit, -count

Microsoft KQL

let staging_ips = dynamic(["45.95.147.178", "160.119.69.4"]);
let ioc_sha256 = dynamic(["c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d", "38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838", "1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9", "b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b", "aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1", "adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c", "d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672"]);
let ioc_md5 = dynamic(["e1ebf9066a951be519a24140711839ea"]);
let watermarks = dynamic(["trace_bd42a8a0d23ae16c85dede7d2abaec05", "trace_7544725ebaaadac217dfaa7ca8e8fe7e", "trace_e1ebf9066a951be519a24140711839ea"]);
union
(
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where SHA256 in~ (ioc_sha256) or MD5 in~ (ioc_md5)
        or (FileName in~ ("wr.php", ".clean.sh") and ActionType in ("FileCreated", "FileModified", "FileRenamed"))
    | extend Evidence = "ioc_file_or_webshell_drop", CommandLine = InitiatingProcessCommandLine
    | project Timestamp, DeviceName, Evidence, ActionType, FileName, FolderPath, SHA256, ParentProcess = InitiatingProcessFileName, CommandLine
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where (FileName in~ ("php", "php-cgi", "php-fpm") and ProcessCommandLine has_any ("str_rot13", "base64_decode"))
        or ProcessCommandLine has_any (watermarks)
        or ProcessCommandLine has_any (staging_ips)
        or (InitiatingProcessFileName in~ ("httpd", "apache2", "php-fpm", "php-cgi") and FileName in~ ("sh", "bash", "dash", "curl", "wget"))
    | extend Evidence = "webshell_execution_or_dropper", ActionType = "ProcessCreated", CommandLine = ProcessCommandLine
    | project Timestamp, DeviceName, Evidence, ActionType, FileName, FolderPath, SHA256, ParentProcess = InitiatingProcessFileName, CommandLine
)
| order by Timestamp desc

Sigma

title: INJ3CTOR3 JOMANGY/ZenharR Web Shell Execution and Dropper Staging on PBX Hosts
id: 3f6b8c1e-5a2d-4e97-9b3c-71d0a4e2c001
status: experimental
description: Detects the web tier (httpd, apache2, php-fpm) spawning shells or download utilities, curl or wget piped into a shell, and command lines touching INJ3CTOR3 staging servers 45.95.147.178 and 160.119.69.4, the /hima_data/ credential collector, wr.php or the EncystPHP-related .clean.sh artifact on FreePBX, Issabel, Elastix and Asterisk hosts.
references:
  - https://cyble.com/blog/jomangy-inj3ctor3s-self-healing-freepbx-toll-fraud-campaign
  - https://cybersecuritynews.com/hackers-attack-freepbx-servers/
  - https://unit42.paloaltonetworks.com/digium-phones-web-shell/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_web_parent:
        ParentImage|endswith:
            - '/httpd'
            - '/apache2'
            - '/php-fpm'
            - '/php-cgi'
            - '/php'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
    selection_staging:
        CommandLine|contains:
            - '45.95.147.178'
            - '160.119.69.4'
            - 'hima_data'
            - '/wr.php'
            - '/.clean.sh'
    selection_pipe:
        CommandLine|re: '(curl|wget)\s[^|]*\|\s*(ba|da)?sh'
    condition: selection_web_parent or selection_staging or selection_pipe
falsepositives:
    - FreePBX modules or admin scripts that legitimately shell out from PHP (for example fwconsole wrappers)
    - Administrators installing software with curl piped to bash
level: high

Known false positives:

• FreePBX modules and admin scripts that legitimately shell out from PHP as the asterisk user
• Administrators installing packages with curl piped to bash

Tuning notes: Baseline legitimate web-parent shell spawns per host (fwconsole, module installs) and exclude them by CommandLine. If Sysmon for Linux is not deployed, adapt field names (ParentImage, Image, CommandLine, User) to auditd EXECVE via the Splunk Add-on for Unix and Linux.

• 🔒 INJ3CTOR3 JOMANGY Webshell Artifacts, Obfuscated PHP Execution and Rotated Watermarks (KQL) · unlock with TL Creds
• 🔒 INJ3CTOR3 Defense Evasion: History and Log Clearing, FreePBX Permission Changes (KQL) · unlock with TL Creds
• 🔒 INJ3CTOR3 PBX Credential File Harvest and Staging Server Connections (KQL) · unlock with TL Creds
• 🔒 INJ3CTOR3 Web Shell Execution and Dropper Staging on PBX Hosts (Sigma) · unlock with TL Creds
• 🔒 INJ3CTOR3 Backdoor Account, Profile Stager and Cron Persistence (Sigma) · unlock with TL Creds
• 🔒 INJ3CTOR3 Credential Collector Proxy Traffic (Sigma) · unlock with TL Creds
• 🔒 INJ3CTOR3 Self-Healing Persistence: Backdoor UID-0 Accounts, Profile Stagers and Cron C2 Polling (SPL) · unlock with TL Creds
• 🔒 INJ3CTOR3 Credential Collector Exfiltration to /hima_data/[indicator] and Staging Servers (SPL) · unlock with TL Creds

Indicators of compromise for JOMANGY FreePBX webshell

As of 2026-10-29, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-4735.

Sample indicators (3 of 20)

• IP address: 45.95.147[.]178
• File hash: c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d
• IP address: 160.119.69[.]4

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Community OSINT corroboration for JOMANGY FreePBX webshell

4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How JOMANGY FreePBX webshell works

Cyble Research & Intelligence Labs (CRIL) published analysis on 2026-10-28 of artifacts collected from INJ3CTOR3 staging servers in September 2026. JOMANGY was first publicly documented by Cyble in May 2026 as a previously undocumented PHP webshell family delivered by a multi-stage Bash dropper alongside ZenharR, a webshell lineage previously attributed to the same actor cluster. In the September 2026 artifacts, INJ3CTOR3 had rotated JOMANGY's identifiers (new watermark strings) and added credential theft to the toolkit.

The campaign targets FreePBX, Issabel, Elastix, Asterisk and Postfix installations. Per the reporting, the malware extracts configuration files containing SIP/PJSIP authentication settings (SIP trunk passwords), Asterisk Manager Interface credentials, database passwords and outbound mail relay authentication details, and posts them to a credential collector at /hima_data/index.php on two staging servers (45.95.147.178 and 160.119.69.4). Two encoded command groups direct uploads to the two separate staging servers. Because the stolen carrier credentials let the actor register the trunk from other machines and place calls without leaving records on the cleaned server, toll fraud can continue after remediation of the host. Cyble also notes that lab testing showed attackers can plant Asterisk trunks directly in configuration files, enabling calls without console visibility, so a normal-looking FreePBX dashboard is not proof a server is clean.

Persistence is described as a six-layer, self-healing design: a cron-based C2 polling job (payload fetched every one to three minutes; installers executed on a minute interval, repeatedly exposing secrets while infected), shell profile stagers (.bashrc/.profile) that fire on root login and reboot, protected crontab backups used to restore cron jobs, process watchdogs that restart killed components, multiple webshell copies across directories, and a PHP-based execution chain that restores components. The May 2026 Cyble report also describes 18 backdoor OS accounts (nine UID-0 accounts with innocuous names and eight service-tier accounts sharing identical MD5-crypt hashes), obfuscation of JOMANGY with Base64 over ROT13 yielding near-zero AV detection, permission changes to legitimate FreePBX components, and removal of competing webshells. Web-server rewrite rules are modified so obfuscated requests reach the webshells without logging webshell file names, and logs and command histories are cleared to hinder reconstruction.

The source article does not state a CVE or CVSS for the September 2026 activity. Related INJ3CTOR3 activity documented elsewhere exploited CVE-2019-19006 (2020), and in December 2025 onward CVE-2025-64328 (FreePBX filestore command injection, CVSS 8.6 per SecPod) to deploy the EncystPHP webshell on 900+ systems; secondary coverage of the Cyble May 2026 report also names CVE-2025-64328 and CVE-2025-57819 (pre-auth SQLi in the Endpoint module). These are listed as related context only and are not asserted as the confirmed initial access vector for the September 2026 staging artifacts. ZenharR/ZenharPanel was earlier documented by Palo Alto Unit 42 (Digium phones web shell campaign, CVE-2021-45461, Dec 2021-Mar 2022). Severity is analyst-assigned based on active exploitation and credential-theft/toll-fraud impact. Attribution confidence is MEDIUM: linkage rests on Cyble's assessment of tooling lineage and reporting from other vendors.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1070.003 Clear Command History

Persistence

T1053.003 Cron; T1136.001 Local Account; T1505.003 Web Shell; T1546.004 Unix Shell Configuration Modification

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1222.002 Linux and Mac Permissions; T1685.006 Clear Linux or Mac System Logs

Credential Access

T1552.001 Credentials In Files

Remediation for JOMANGY FreePBX webshell

Patches

• Update FreePBX modules to current vendor releases (FreePBX Endpoint Manager 17.0.3 fixes CVE-2025-64328 per SecPod)

Immediate actions

• Isolate affected FreePBX/Issabel/Elastix/Asterisk hosts and preserve forensic evidence (disk, logs, crontabs, web-server configs) before removal
• Block outbound traffic to 45.95.147.178 and 160.119.69.4 and alert on HTTP requests to /hima_data/index.php
• Remove all persistence layers: cron entries, shell profile stagers, protected crontab backups, watchdog processes, webshell copies and backdoor OS accounts
• Rotate ALL exposed credentials (SIP trunk secrets, AMI, database, mail relay) only after persistence is removed, since rotating while infected can hand the new secrets to the attacker
• Coordinate with SIP carriers to replace trunk secrets and review registrations and call detail records

Workarounds

• Restrict administrator control panel access to trusted networks
• Apply carrier-side call limits and destination restrictions to cap toll-fraud losses

Longer-term hardening

• Rebuild affected servers from trusted images, which Cyble reports is the most reliable recovery option
• Restrict allowed source IP addresses for SIP trunks and expose the FreePBX admin interface only to trusted networks
• Monitor for unexpected SIP registrations, premium-rate or international calls and unusual call concurrency
• Inspect Asterisk configuration files directly for planted trunks rather than relying on the FreePBX dashboard

Affected and fixed versions

• Sangoma — FreePBX
• Issabel — Issabel PBX
• Elastix — Elastix PBX
• Asterisk — Asterisk
• Postfix — Postfix mail relay configurations on PBX hosts

Timeline of JOMANGY FreePBX webshell

• 2019-01-01 locked-ioc-17 reported (Cyble/Daily Security Review) as financially motivated actor targeting VoIP infrastructure since 2019; exact date not stated.
• 2021-12-31 Late Dec 2021 to Mar 2022: locked-ioc-19/ZenharPanel webshell campaign against Digium phones on Elastix/FreePBX (CVE-2021-45461) later documented by Palo Alto Unit 42.
• 2025-12-01 Early December 2025: locked-ioc-17 begins exploiting CVE-2025-64328 in FreePBX to deploy the locked-ioc-16 webshell; 900+ systems later reported compromised (SecPod).
• 2026-01-28 Fortinet publishes analysis of the locked-ioc-16 weaponized web shell.
• 2026-05-22 Cyble first documents locked-ioc-18, a previously undocumented PHP webshell, deployed with locked-ioc-19 via a Bash dropper with six-layer self-healing persistence.
• 2026-09-01 September 2026: researchers collect artifacts from locked-ioc-17 staging servers locked-ioc-12 and locked-ioc-13 showing rotated locked-ioc-18 identifiers and added credential theft.
• 2026-10-28 Cyble Research & Intelligence Labs publishes analysis of the upgraded locked-ioc-18/locked-ioc-19 toolkit and SIP credential exfiltration.
• 2026-10-29 Cyber Security News and The Cyber Express report the campaign stealing FreePBX credentials and enabling toll fraud after cleanup.

Sources cited for JOMANGY FreePBX webshell

• Cyble: JOMANGY - INJ3CTOR3's Self-Healing FreePBX Toll Fraud Campaign cyble.com · Research · 2026-05-22
• Ongoing Web Shell Attacks Hit 900+ FreePBX Systems: INJ3CTOR3 Behind EncystPHP Deployment (SecPod) secpod.com · Research · 2026-02-01
• Fortinet: Unveiling the Weaponized Web Shell EncystPHP Fortinet · Vendor report · 2026-01-28
• Palo Alto Unit 42: Digium Phones Web Shell (ZenharR) Unit 42 · Research · 2022-03-01
• Hackers Attack FreePBX Servers With Malware to Steal SIP Credentials for Phone Fraud cybersecuritynews.com · News · 2026-10-29
• INJ3CTOR3 Deploys JOMANGY Webshell in FreePBX Campaign (Daily Security Review) dailysecurityreview.com · News · 2026-05-22
• The Cyber Express: JOMANGY coverage archive (INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup) thecyberexpress.com · News · 2026-10-29
• Threat Actors Deploy Multi-Layer Persistence On Compromised FreePBX Servers cyberpress.org · News · 2026-05-22

More in malware

• HEAVYGRAM: Telegram-based Surveillance Backdoor Linked to Handala Hack (Void Manticore / MOIS)
• Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps
• Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2
• Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction
• China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)