Date: 11/02/2026
Severity: High
Summary
INJ3CTOR3 has upgraded its FreePBX toll-fraud campaign by adding credential theft to its existing JOMANGY webshell. The malware now steals sensitive SIP trunk, AMI, database, and mail-relay credentials and sends them to attacker-controlled servers every minute. This allows attackers to continue making unauthorized calls even after the infected PBX is cleaned or rebuilt. The campaign also uses multiple C2 staging servers and rotated detection identifiers, making it harder for defenders to detect and stop. Organizations using FreePBX, Issabel, or Elastix must remove the infection, investigate credential exposure, and rotate all affected secrets to prevent further abuse.
Indicators of Compromise (IOC) List
Domains/URLs | http://45.95.147.178/hima_data/index.php http://160.119.69.4/hima_data/index.php |
IP Address | 45.95.147.178 160.119.69.4 |
Hash | 8b3a1d970fda0c17a0b785a990fb7b6a
c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d
38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838
1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9
b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b
aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1
adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c
d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "http://160.119.69.4/hima_data/index.php" or url like "http://160.119.69.4/hima_data/index.php" or siteurl like "http://160.119.69.4/hima_data/index.php" or domainname like "http://45.95.147.178/hima_data/index.php" or url like "http://45.95.147.178/hima_data/index.php" or siteurl like "http://45.95.147.178/hima_data/index.php" |
Detection Query 2 : | dstipaddress IN ("45.95.147.178","160.119.69.4") or srcipaddress IN ("45.95.147.178","160.119.69.4") |
Detection Query 3 : | md5hash IN ("8b3a1d970fda0c17a0b785a990fb7b6a")
|
Detection Query 4 : | sha256hash IN ("c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d","38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838","1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9","b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b","aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1","adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c","d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672")
|
Reference:
INJ3CTOR3 FreePBX Campaign Expands to Credential Theft and Toll Fraud