Critical FreePBX Flaw Lets Attackers Maintain Access with Six Persistence Layers

Key Takeaways

• The INJ3CTOR3 hacking group is actively deploying a sophisticated PHP webshell, JOMANGY, against FreePBX systems.
• JOMANGY employs six distinct, self-healing persistence mechanisms, making it exceptionally difficult to remove.
• The primary goal of the campaign is toll fraud, exploiting compromised VoIP systems to route calls at victims’ expense.
• Two critical vulnerabilities, CVE-2025-64328 and CVE-2025-57819, are identified as likely initial access points, though patching alone does not remove the webshell.
• Detection rates for the webshell are extremely low, with many components going undetected by major antivirus engines.

A new, highly resilient PHP webshell, dubbed JOMANGY, is being actively deployed by the INJ3CTOR3 hacker group in a campaign targeting FreePBX systems. This sophisticated malware is designed with six interconnected persistence layers, ensuring deep embedment and self-healing capabilities within compromised servers.

The campaign’s primary objective is toll fraud, leveraging internet-exposed Voice over IP (VoIP) phone systems to reroute calls through premium-rate numbers controlled by the attackers. This scheme allows the hackers to generate revenue at the victims’ expense, avoiding the complexities and overhead typically associated with ransomware or data exfiltration. Researchers have identified a target list exceeding 3,000 IP addresses, indicating a strategy focused on widespread automated exploitation.

FreePBX, an open-source web interface, is widely used by organizations to manage phone systems built on the Asterisk software. These installations often handle live carrier accounts with Session Initiation Protocol (SIP) trunks, capable of originating actual phone calls.

Analysts at Cyble Research and Intelligence Labs (CRIL) were instrumental in identifying and detailing this campaign in a comprehensive report. The operation has been confidently attributed to INJ3CTOR3, a threat actor known for targeting VoIP infrastructure for financial gain since at least 2019. Previous iterations of their campaigns were documented by Check Point Research in 2020, Palo Alto Unit 42 in 2022, and Fortinet in January 2026.

The Shadowserver Foundation reported that over 900 FreePBX hosts were compromised during the January 2026 wave of attacks. Alarmingly, by May 2026, more than 700 of these systems remained infected, highlighting the formidable challenge in eradicating these infections even after initial vulnerabilities have been addressed.

Two vulnerabilities are considered the most probable entry points for the current campaign: CVE-2025-64328, a post-authentication command injection flaw within the FreePBX filestore module, and CVE-2025-57819, a pre-authentication SQL injection vulnerability found in the FreePBX Endpoint module. While both vulnerabilities have been patched in recent FreePBX releases, applying these patches to an already compromised system is insufficient, as the webshell’s persistence mechanisms can readily re-establish the infection.

Advanced Persistence Mechanisms of JOMANGY

The distinguishing feature of this campaign is the sophisticated engineering of its persistence. JOMANGY’s six persistence channels are not merely redundant backups; they are designed to be self-healing, with each layer capable of reconstructing every other component. This interdependency means that even if five of the six channels are removed, the attackers retain a recovery window measured in mere minutes.

The first persistence layer involves scheduled cron jobs that poll the attacker’s command-and-control (C2) server every one to three minutes. This ensures the continuous re-download and re-execution of the dropper. The second layer injects malicious code into shell profile files, triggering a re-infection payload upon every root login or system reboot. The third mechanism involves creating eight immutable copies of the crontab in hidden directories. These copies are protected by file attributes that prevent deletion, even by a root user, and are further reinforced by two separate restore loops.

A fourth layer acts as a process watchdog, immediately re-downloading the dropper if any of the beacon processes cease to run. The fifth involves scattering webshell copies across more than a dozen paths within the FreePBX web directory, many of which are also marked as immutable. A single authenticated request to any surviving webshell instance is sufficient to rebuild the entire infection stack. Finally, the sixth layer leverages a PHP executor embedded in the FreePBX high-availability module, providing privileged command execution capabilities independently of the other persistence mechanisms.

Stealth and Backdoor Accounts

Beyond its intricate persistence, JOMANGY establishes 18 backdoor accounts across three privilege tiers. Nine of these accounts possess full root-equivalent privileges, while eight operate at the service account level. One additional administrative account is injected directly into the FreePBX web panel database via MySQL. The attackers strategically chose common account names such as “asterisk,” “freepbxuser,” and “spamfilter” to evade detection by blending in with legitimate system accounts.

Adding to its stealth, JOMANGY was previously undocumented before this analysis and employs a double-layer obfuscation technique combining base64 encoding and ROT13 to bypass automated security scanners. At the time of the research, the primary dropper had only four detections across 76 antivirus engines on VirusTotal, while critical components like k.php and wr.php showed zero detections, underscoring the malware’s low detection rate.

What You Should Do

• Assume Full Compromise: If a FreePBX system is confirmed to be infected, assume a complete compromise.
• Rebuild from a Clean Baseline: The highly persistent and self-healing nature of JOMANGY means that attempts to manually clean an infected system are unlikely to be successful. A full rebuild from a clean, trusted backup is the recommended course of action.
• Patch Immediately: Ensure all FreePBX installations are updated to the latest versions to patch vulnerabilities like CVE-2025-64328 and CVE-2025-57819.
• Monitor for IoCs: Implement robust monitoring for the provided Indicators of Compromise (IoCs) within your network and endpoint security solutions.
• Review User Accounts: Scrutinize all user and service accounts for any unauthorized additions or suspicious activity, especially those mimicking legitimate FreePBX accounts.
• Network Segmentation: Isolate FreePBX systems from other critical network segments to limit potential lateral movement in case of compromise.
• Restrict Exposure: Minimize internet exposure of FreePBX systems. Where remote access is required, enforce strong authentication, VPNs, and IP whitelisting.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.