Threat video1:00
INJ3CTOR3 JOMANGY FreePBX SIP Theft: Detection & IOCs
INJ3CTOR3 drops JOMANGY and ZenharR webshells on FreePBX to steal SIP credentials. 9 detection rules, 20 IOCs and a free Splunk SPL rule.
Read the full threat intel for INJ3CTOR3 JOMANGY FreePBX SIP Theft: Detection & IOCs →
Chapters
- 0:00The hookSix layer persistence survives cleanup.
- 0:04The storyCredentials stolen.
- 0:10Attack pathBash dropper plants obfuscated webshells, six layer persistence.
- 0:21AttributionAttributed to INJ3CTOR3.
- 0:26Indicators of compromise16 indicators to hunt: 3 IPs, 2 URLs and 7 SHA-256 hashes, and more.
- 0:35MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to command and control.
- 0:40Remediation5 steps now: Isolate affected FreePBX/Issabel/Elastix/Asterisk hosts and preserve forensic evidence before removal.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Six layer persistence survives cleanup.
0:05Credentials stolen.
0:06Toll fraud continues.
0:10Bash dropper plants obfuscated webshells, six layer persistence.
0:15Credentials taken, sent to servers: toll fraud.
0:21Attributed to INJ3CTOR3. Confidence: medium.
0:2616 indicators to hunt: 3 IPs, 2 URLs and 7 SHA-256 hashes, and more.
0:3512 ATT&CK techniques, from initial access to command and control.
0:405 steps now: Isolate affected FreePBX/Issabel/Elastix/Asterisk hosts and preserve forensic evidence before removal.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.