In a concerning development, cybercriminals have intensified their attacks on FreePBX phone servers by enhancing malware capable of extracting sensitive credentials. This strategy enables phone fraud operations to persist even after compromised systems undergo rebuilding.
Understanding the Expanded Threat
The notorious INJ3CTOR3 campaign has broadened its scope to capture critical configuration files, including SIP trunk passwords, database credentials, and more. This advancement significantly extends the potential damage, impacting systems beyond the initial server breach.
Initially, the campaign exploited vulnerabilities to make unauthorized phone calls via compromised systems. The latest malware iteration now leverages stolen carrier credentials, allowing attackers to charge calls to victims’ accounts even without direct access to the original system.
Insight from Cybersecurity Researchers
Experts from Cyble Research & Intelligence Labs uncovered these malware enhancements during an analysis of artifacts from staging servers in September 2026. Their findings, published on October 28, detail an installer designed to continuously upload 17 files. Although researchers identified the upload commands, they could not determine the number of impacted victims.
The updated installer includes two distinct command sets, each directing configuration file uploads to separate staging servers. These actions are automated through scheduled tasks that run every minute, perpetuating the exposure of sensitive information while the infection persists.
Mitigation and Defensive Measures
To counteract these attacks, it is crucial to change passwords before removing the malware. The compromised files encompass configurations from FreePBX, Issabel, Elastix, Asterisk, and Postfix platforms, making it imperative to secure both calling services and ancillary infrastructure.
The stolen SIP trunk credentials are particularly valuable for attackers, as they authenticate businesses’ connections to telephone providers. Without restrictions on IP addresses, these credentials enable attackers to register from different machines, making unauthorized calls that remain undetected on cleaned systems.
Future Outlook and Recommendations
The operation continues to use webshells like JOMANGY and ZenharR, which allow remote command execution and access to phone system functionalities. These tactics, combined with administrative access and backdoor accounts, underscore the need for robust security measures.
To mitigate risks, administrators should collaborate with carriers to replace compromised credentials, monitor for unusual activities, and implement spending limits. Comprehensive recovery involves rebuilding systems from trusted images and maintaining vigilant monitoring against potential threats.
As cyber threats evolve, staying informed and proactive is essential for organizations relying on VoIP infrastructure. Continuous collaboration with cybersecurity experts and adherence to best practices can significantly reduce the risk of future compromises.
