# INJ3CTOR3 Campaign Targets FreePBX Servers with JOMANGY/ZenharR Webshells to Steal SIP Credentials for Phone Fraud

> INJ3CTOR3, a financially motivated actor active against VoIP infrastructure since 2019, is compromising FreePBX, Issabel, Elastix, Asterisk and Postfix hosts with a Bash dropper and the JOMANGY and ZenharR PHP webshells. The upgraded tooling exfiltrates SIP trunk, Asterisk Manager, database and mail relay credentials to staging servers so the actor can place unauthorized calls (toll fraud) even after the victim cleans the host.

- **Published:** 2026-10-29T11:54:56Z
- **Last reviewed:** 2026-10-29T11:54:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4735
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4735.png
- **ID:** TL-2026-4735
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** INJ3CTOR3
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Cyble Research & Intelligence Labs (CRIL) published analysis on 2026-10-28 of artifacts collected from INJ3CTOR3 staging servers in September 2026. JOMANGY was first publicly documented by Cyble in May 2026 as a previously undocumented PHP webshell family delivered by a multi-stage Bash dropper alongside ZenharR, a webshell lineage previously attributed to the same actor cluster. In the September 2026 artifacts, INJ3CTOR3 had rotated JOMANGY's identifiers (new watermark strings) and added credential theft to the toolkit.

The campaign targets FreePBX, Issabel, Elastix, Asterisk and Postfix installations. Per the reporting, the malware extracts configuration files containing SIP/PJSIP authentication settings (SIP trunk passwords), Asterisk Manager Interface credentials, database passwords and outbound mail relay authentication details, and posts them to a credential collector at /hima_data/index.php on two staging servers (45.95.147.178 and 160.119.69.4). Two encoded command groups direct uploads to the two separate staging servers. Because the stolen carrier credentials let the actor register the trunk from other machines and place calls without leaving records on the cleaned server, toll fraud can continue after remediation of the host. Cyble also notes that lab testing showed attackers can plant Asterisk trunks directly in configuration files, enabling calls without console visibility, so a normal-looking FreePBX dashboard is not proof a server is clean.

Persistence is described as a six-layer, self-healing design: a cron-based C2 polling job (payload fetched every one to three minutes; installers executed on a minute interval, repeatedly exposing secrets while infected), shell profile stagers (.bashrc/.profile) that fire on root login and reboot, protected crontab backups used to restore cron jobs, process watchdogs that restart killed components, multiple webshell copies across directories, and a PHP-based execution chain that restores components. The May 2026 Cyble report also describes 18 backdoor OS accounts (nine UID-0 accounts with innocuous names and eight service-tier accounts sharing identical MD5-crypt hashes), obfuscation of JOMANGY with Base64 over ROT13 yielding near-zero AV detection, permission changes to legitimate FreePBX components, and removal of competing webshells. Web-server rewrite rules are modified so obfuscated requests reach the webshells without logging webshell file names, and logs and command histories are cleared to hinder reconstruction.

The source article does not state a CVE or CVSS for the September 2026 activity. Related INJ3CTOR3 activity documented elsewhere exploited CVE-2019-19006 (2020), and in December 2025 onward CVE-2025-64328 (FreePBX filestore command injection, CVSS 8.6 per SecPod) to deploy the EncystPHP webshell on 900+ systems; secondary coverage of the Cyble May 2026 report also names CVE-2025-64328 and CVE-2025-57819 (pre-auth SQLi in the Endpoint module). These are listed as related context only and are not asserted as the confirmed initial access vector for the September 2026 staging artifacts. ZenharR/ZenharPanel was earlier documented by Palo Alto Unit 42 (Digium phones web shell campaign, CVE-2021-45461, Dec 2021-Mar 2022). Severity is analyst-assigned based on active exploitation and credential-theft/toll-fraud impact. Attribution confidence is MEDIUM: linkage rests on Cyble's assessment of tooling lineage and reporting from other vendors.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1053.003 Cron
- T1546.004 Unix Shell Configuration Modification
- T1136.001 Local Account
- T1027 Obfuscated Files or Information
- T1685.006 Clear Linux or Mac System Logs
- T1070.003 Clear Command History
- T1222.002 Linux and Mac Permissions
- T1552.001 Credentials In Files
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**INJ3CTOR3 JOMANGY/ZenharR Web-Tier Shell Spawn and Staging Dropper Fetch (SPL)** (`TL-2026-4735-SPL-001`)

Behaviour-first search for the INJ3CTOR3 Bash dropper and PHP webshell execution on FreePBX/Issabel/Elastix/Asterisk hosts: web server or PHP processes spawning shells, curl/wget piped into a shell, and any command line touching staging servers 45.95.147.178 and 160.119.69.4, the /hima_data/ collector, wr.php or .clean.sh.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004, T1505.003
- **Data sources:** sysmon_for_linux, linux_process_creation, index=linux sourcetype=sysmon:linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/php")
| eval web_parent=if(match(ParentImage,"/(httpd|apache2|php-fpm[0-9.]*|php-cgi|php)$"),1,0)
| eval staging_hit=if(match(CommandLine,"45[.]95[.]147[.]178|160[.]119[.]69[.]4|hima_data|/wr[.]php|/[.]clean[.]sh"),1,0)
| eval pipe_to_shell=if(match(CommandLine,"(curl|wget)[^|]*[|][ ]*(ba|da)?sh"),1,0)
| where staging_hit=1 OR pipe_to_shell=1 OR (web_parent=1 AND match(Image,"/(sh|bash|dash)$"))
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parents values(CommandLine) as commands max(staging_hit) as staging_hit by host User
| convert ctime(first_seen) ctime(last_seen)
| sort -staging_hit, -count
```

### Microsoft KQL

```kql
let staging_ips = dynamic(["45.95.147.178", "160.119.69.4"]);
let ioc_sha256 = dynamic(["c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d", "38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838", "1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9", "b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b", "aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1", "adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c", "d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672"]);
let ioc_md5 = dynamic(["e1ebf9066a951be519a24140711839ea"]);
let watermarks = dynamic(["trace_bd42a8a0d23ae16c85dede7d2abaec05", "trace_7544725ebaaadac217dfaa7ca8e8fe7e", "trace_e1ebf9066a951be519a24140711839ea"]);
union
(
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where SHA256 in~ (ioc_sha256) or MD5 in~ (ioc_md5)
        or (FileName in~ ("wr.php", ".clean.sh") and ActionType in ("FileCreated", "FileModified", "FileRenamed"))
    | extend Evidence = "ioc_file_or_webshell_drop", CommandLine = InitiatingProcessCommandLine
    | project Timestamp, DeviceName, Evidence, ActionType, FileName, FolderPath, SHA256, ParentProcess = InitiatingProcessFileName, CommandLine
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where (FileName in~ ("php", "php-cgi", "php-fpm") and ProcessCommandLine has_any ("str_rot13", "base64_decode"))
        or ProcessCommandLine has_any (watermarks)
        or ProcessCommandLine has_any (staging_ips)
        or (InitiatingProcessFileName in~ ("httpd", "apache2", "php-fpm", "php-cgi") and FileName in~ ("sh", "bash", "dash", "curl", "wget"))
    | extend Evidence = "webshell_execution_or_dropper", ActionType = "ProcessCreated", CommandLine = ProcessCommandLine
    | project Timestamp, DeviceName, Evidence, ActionType, FileName, FolderPath, SHA256, ParentProcess = InitiatingProcessFileName, CommandLine
)
| order by Timestamp desc
```

### Sigma

```yaml
title: INJ3CTOR3 JOMANGY/ZenharR Web Shell Execution and Dropper Staging on PBX Hosts
id: 3f6b8c1e-5a2d-4e97-9b3c-71d0a4e2c001
status: experimental
description: Detects the web tier (httpd, apache2, php-fpm) spawning shells or download utilities, curl or wget piped into a shell, and command lines touching INJ3CTOR3 staging servers 45.95.147.178 and 160.119.69.4, the /hima_data/ credential collector, wr.php or the EncystPHP-related .clean.sh artifact on FreePBX, Issabel, Elastix and Asterisk hosts.
references:
  - https://cyble.com/blog/jomangy-inj3ctor3s-self-healing-freepbx-toll-fraud-campaign
  - https://cybersecuritynews.com/hackers-attack-freepbx-servers/
  - https://unit42.paloaltonetworks.com/digium-phones-web-shell/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_web_parent:
        ParentImage|endswith:
            - '/httpd'
            - '/apache2'
            - '/php-fpm'
            - '/php-cgi'
            - '/php'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
    selection_staging:
        CommandLine|contains:
            - '45.95.147.178'
            - '160.119.69.4'
            - 'hima_data'
            - '/wr.php'
            - '/.clean.sh'
    selection_pipe:
        CommandLine|re: '(curl|wget)\s[^|]*\|\s*(ba|da)?sh'
    condition: selection_web_parent or selection_staging or selection_pipe
falsepositives:
    - FreePBX modules or admin scripts that legitimately shell out from PHP (for example fwconsole wrappers)
    - Administrators installing software with curl piped to bash
level: high

```

**Known false positives:**

- FreePBX modules and admin scripts that legitimately shell out from PHP as the asterisk user
- Administrators installing packages with curl piped to bash

**Tuning notes:** Baseline legitimate web-parent shell spawns per host (fwconsole, module installs) and exclude them by CommandLine. If Sysmon for Linux is not deployed, adapt field names (ParentImage, Image, CommandLine, User) to auditd EXECVE via the Splunk Add-on for Unix and Linux.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- INJ3CTOR3 JOMANGY Webshell Artifacts, Obfuscated PHP Execution and Rotated Watermarks (KQL) (locked: unlock with TL Creds)
- INJ3CTOR3 Defense Evasion: History and Log Clearing, FreePBX Permission Changes (KQL) (locked: unlock with TL Creds)
- INJ3CTOR3 PBX Credential File Harvest and Staging Server Connections (KQL) (locked: unlock with TL Creds)
- INJ3CTOR3 Web Shell Execution and Dropper Staging on PBX Hosts (Sigma) (locked: unlock with TL Creds)
- INJ3CTOR3 Backdoor Account, Profile Stager and Cron Persistence (Sigma) (locked: unlock with TL Creds)
- INJ3CTOR3 Credential Collector Proxy Traffic (Sigma) (locked: unlock with TL Creds)
- INJ3CTOR3 Self-Healing Persistence: Backdoor UID-0 Accounts, Profile Stagers and Cron C2 Polling (SPL) (locked: unlock with TL Creds)
- INJ3CTOR3 Credential Collector Exfiltration to /hima_data/[indicator] and Staging Servers (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `45.95.147[.]178`
- File hash: `c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d`
- IP address: `160.119.69[.]4`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Attack FreePBX Servers With Malware to Steal SIP Credentials for Phone Fraud](https://cybersecuritynews.com/hackers-attack-freepbx-servers/)
- [Cyble: JOMANGY - INJ3CTOR3's Self-Healing FreePBX Toll Fraud Campaign](https://cyble.com/blog/jomangy-inj3ctor3s-self-healing-freepbx-toll-fraud-campaign)
- [INJ3CTOR3 Deploys JOMANGY Webshell in FreePBX Campaign (Daily Security Review)](https://dailysecurityreview.com/threat-actors/inj3ctor3-deploys-jomangy-webshell-in-freepbx-campaign/)
- [The Cyber Express: JOMANGY coverage archive (INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup)](https://thecyberexpress.com/tag/jomangy/)
- [Threat Actors Deploy Multi-Layer Persistence On Compromised FreePBX Servers](https://cyberpress.org/freepbx-hit-with-persistence/)
- [Ongoing Web Shell Attacks Hit 900+ FreePBX Systems: INJ3CTOR3 Behind EncystPHP Deployment (SecPod)](https://www.secpod.com/learn/security-research/ongoing-web-shell-attacks-hit-900-freepbx-systems-inj3ctor3-behind-encystphp-deployment)
- [Fortinet: Unveiling the Weaponized Web Shell EncystPHP](https://www.fortinet.com/it/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp)
- [Palo Alto Unit 42: Digium Phones Web Shell (ZenharR)](https://unit42.paloaltonetworks.com/digium-phones-web-shell/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4735