Hackers use six-layer persistence to keep access to compromised FreePBX systems

A financially motivated threat actor is targeting exposed FreePBX servers with a newly documented PHP webshell called JOMANGY, using six persistence layers to keep access even after partial cleanup attempts.

The Cyble report links the campaign with high confidence to INJ3CTOR3, a group known for abusing VoIP infrastructure for toll fraud. The attacker’s goal is simple: route calls through a victim’s PBX system and leave the organization to pay the telecom bill.

FreePBX is widely used to manage Asterisk-based phone systems. These servers often connect to real SIP trunks, carrier accounts, extensions, and call-routing rules, which makes them valuable targets for attackers who want direct financial gain rather than data theft.

JOMANGY is built to survive cleanup

Cyble describes JOMANGY as a previously undocumented PHP webshell family deployed through a multi-stage Bash dropper. The malware also appears alongside ZenharR, a toolkit previously linked to the same actor lineage.

The campaign’s most important feature is resilience. The persistence channels are not simple backups. Each surviving layer can help restore other parts of the infection, which means a defender who removes only some files or cron jobs may see the system reinfected within minutes.

The Cyble analysis says the attacker’s C2-hosted inventory contained 3,080 IP addresses, suggesting mass scanning and automated targeting of exposed systems.

Campaign detail	What researchers found
Threat actor	INJ3CTOR3
Main malware	JOMANGY PHP webshell
Additional toolkit	ZenharR
Main goal	VoIP toll fraud through victim SIP trunks
Persistence model	Six self-healing channels
Observed target inventory	3,080 IP addresses

Why FreePBX servers are attractive targets

PBX servers sit at the intersection of internet exposure, business communications, and telecom billing. If attackers gain control, they can initiate outbound calls, query SIP peers, inspect Asterisk channels, and abuse carrier connectivity.

That makes toll fraud different from many other cybercrime models. The attacker does not need to encrypt files or steal databases to make money. They can route calls through premium-rate destinations or other monetized call paths while the victim absorbs the cost.

Check Point Research previously described INJ3CTOR3 activity as part of a profitable model built around compromising VoIP servers and using them to make outgoing calls.

The six persistence layers

The JOMANGY campaign uses multiple overlapping mechanisms to stay active. Some run through cron jobs, others through shell profiles, immutable files, watchdog processes, webshell copies, and a FreePBX high-availability module path.

This design creates a cleanup trap. If administrators remove a webshell but miss cron entries, the dropper can return. If they remove cron entries but miss a profile injection or PHP executor, the infection can rebuild.

• Cron jobs poll the command-and-control server every one to three minutes.
• Shell profile changes trigger reinfection on root login and reboot.
• Hidden crontab backups restore scheduled tasks after removal.
• A process watchdog checks whether beaconing processes disappear.
• Multiple webshell copies sit across the FreePBX web tree.
• A PHP executor in the high-availability module provides another command path.

Backdoor accounts make recovery harder

The infection also creates 18 backdoor accounts across operating system and FreePBX layers. Nine carry root-equivalent privileges, eight operate at a service-account level, and one appears inside the FreePBX web panel database.

Several account names are chosen to look familiar on a PBX server, including names that resemble Asterisk, FreePBX, support, and maintenance accounts. This makes manual review harder because a rushed administrator may overlook them as normal service users.

That account strategy gives the attacker more than web access. It can preserve shell access, web panel access, and service-level control even when some malware files disappear.

Two FreePBX flaws sit at the center of the risk

The current campaign may use more than one entry path, but two FreePBX vulnerabilities matter most for defenders. One is CVE-2025-64328, a post-authentication command injection issue. The other is CVE-2025-57819, an authentication bypass issue leading to SQL injection and remote code execution.

The NVD record for CVE-2025-64328 says affected FreePBX Endpoint Manager versions 17.0.2.36 and above before 17.0.3 can allow an authenticated known user to execute commands through the filestore module and gain remote access as the asterisk user.

The separate FreePBX advisory for CVE-2025-57819 says insufficiently sanitized input can allow unauthenticated access to FreePBX Administrator, arbitrary database manipulation, and remote code execution.

Patching does not remove an existing infection

Updating FreePBX remains essential, but it does not automatically clean a compromised host. Once JOMANGY has installed cron jobs, profile hooks, webshell copies, backdoor users, and PHP executors, the malware can continue running even after the vulnerable module gets patched.

The CVE-2025-64328 entry also shows that CISA added the flaw to its Known Exploited Vulnerabilities catalog in February 2026, which confirms active exploitation risk for exposed deployments.

The FreePBX security advisory recommends upgrading supported versions and checking the endpoint module version. It also points users toward additional access-control and indicator-inspection steps.

Earlier FreePBX webshell attacks set the stage

JOMANGY does not appear in isolation. Earlier activity against FreePBX systems used EncystPHP, another webshell tied to the INJ3CTOR3 ecosystem.

Fortinet’s EncystPHP research said incidents began in early December 2025 and propagated through exploitation of CVE-2025-64328. The webshell provided remote command execution, persistence, and webshell deployment capabilities.

That history matters because the newer JOMANGY campaign appears to build on the same financial playbook while improving resilience. The attacker’s focus stays consistent: compromise VoIP infrastructure, maintain access, and abuse telephony resources for profit.

Hundreds of systems stayed infected after public warnings

The cleanup challenge became visible earlier in 2026. The Hacker News reported that Shadowserver had observed more than 900 Sangoma FreePBX instances still infected with webshells after exploitation tied to CVE-2025-64328.

The February report said many compromised systems were located in the United States, followed by Brazil, Canada, Germany, and France. It also noted that CISA had added CVE-2025-64328 to the KEV catalog.

Cyble’s newer May findings indicate that more than 700 hosts from that earlier wave still remained infected months later. That persistence shows why simple patching, file deletion, or web panel cleanup may not be enough.

Low detection makes the campaign more dangerous

JOMANGY had no prior public documentation before Cyble’s analysis, and the malware uses double-layer obfuscation with base64 and ROT13. That helps it hide from basic automated scanners and makes manual review harder.

The sample detection numbers were also low at the time of research. The primary dropper had only a handful of antivirus detections, while some related PHP components reportedly had none.

For defenders, that means absence of alerts does not prove absence of compromise. PBX systems need direct inspection, not only antivirus scans.

What administrators should check

FreePBX administrators should treat exposed systems as high-risk, especially if they ran vulnerable versions, had internet-exposed administrator panels, or showed unusual call charges.

• Check for unexpected cron jobs running as root or asterisk.
• Review shell profile files for reinfection commands.
• Look for hidden crontab backups and immutable file attributes.
• Search FreePBX web directories for unexpected PHP files.
• Review /etc/passwd for suspicious support or FreePBX-like accounts.
• Inspect the FreePBX ampusers table for unknown administrator accounts.
• Review outbound calls, SIP trunk usage, and unusual destination patterns.
• Check web logs for requests to suspicious PHP paths.

When rebuilding is safer than cleaning

In a confirmed JOMANGY infection, rebuilding from a clean baseline may offer the safest path. The malware’s persistence model gives the attacker too many recovery points, and one missed channel can restore the full infection stack.

Fortinet made a similar point for earlier FreePBX webshell activity, advising immediate remediation and hardening because compromised PBX systems can support long-term persistence, unauthorized administrative access, and abuse of telephony resources.

Administrators should preserve logs and forensic data before wiping systems. They should also rotate credentials, replace SIP trunk secrets, review carrier billing, and block outbound international or premium-rate calling unless the business truly needs it.

Response step	Why it matters
Rebuild from clean media	Removes hidden persistence that manual cleanup may miss
Patch FreePBX and modules	Closes known entry points after recovery
Rotate PBX, SIP, SSH, and database credentials	Prevents reuse of stolen or backdoored access
Restrict administrator panel access	Reduces exposure to internet scanning
Review call records and billing	Identifies toll fraud and carrier abuse
Monitor cron, PHP files, and user accounts	Detects reinfection attempts after restoration

How to reduce the risk

Organizations should keep FreePBX and commercial modules current, but they should also reduce internet exposure. The administrator panel should not face the public internet without strict IP filtering, VPN access, or another protected administrative path.

PBX systems should also have call controls that match business needs. Blocking unnecessary international dialing, setting spending limits, alerting on unusual call volume, and reviewing premium-rate destinations can limit financial damage if attackers gain access.

The older Check Point research on INJ3CTOR3 showed that VoIP monetization has remained attractive for years. The newer JOMANGY activity shows that the same business model now includes stronger persistence and faster reinfection.

The clearest takeaway is that compromised FreePBX systems need full incident response, not routine maintenance. If JOMANGY reaches a PBX server, administrators should assume the attacker built several paths back in and plan recovery accordingly.

FAQ