An underground threat actor is advertising a pre-authentication remote code execution (RCE) zero-day exploit targeting IP PBX software with over 10,000 active installations. Organizations using internet-exposed telephony systems must immediately secure their interfaces to prevent unauthorized administrative takeover.
Unauthenticated remote code execution (RCE) capabilities targeting internet-exposed IP PBX software represent a severe threat to enterprise communications networks, especially when sold as zero-day exploits on cybercrime forums. According to an advertisement discovered on an underground hacking forum, a threat actor is currently selling an exploit targeting a platform with more than 10,000 active installations globally. Because these IP PBX installations manage critical enterprise voice and telecommunications lines, a successful exploitation grants attackers root-level control over the server, leading to immediate operational risk and financial damage.
Critical pre-authentication SQL injection and authentication bypass in FreePBX Endpoint module used for initial access.
Private Branch Exchange installations are primary targets for financially motivated cybercriminals because they bridge internal corporate networks with public telephony networks. Threat actors frequently scan public address spaces to locate exposed administration dashboards, particularly those running Sangoma FreePBX or other Asterisk-based frameworks. When an unauthenticated RCE zero-day exploit becomes available to underground threat groups, the risk rises exponentially because adversaries can bypass login portals entirely without credentials. To prevent these internet-exposed interfaces from becoming immediate entry points, organizations must transition to a proactive operational posture. Implementing robust Attack Surface Management helps map and secure exposed communication portals, while periodic Vulnerability Assessments can highlight unpatched endpoints before attackers can weaponize zero-day capabilities.
Automated discovery of exposed web management portals.
Execution of pre-authentication RCE exploit (such as CVE-2025-57819) to bypass logins.
Bash stager script (`.clean.sh`) is downloaded to establish local execution foothold.
Deletes 50+ rival web shells, blocks competing C2 IPs, and scrubs security access logs.
Installs highly obfuscated JOMANGY PHP shell and seeds 18 backdoor OS accounts.
Bypasses trunk limits to place thousands of high-volume calls to premium-rate lines.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
June 12, 2026
Emerging threats involving hVNC and hRDP zero-day exploits are circulating in underground forums. Organizations must assess their exposure and strengthen remote access security.
June 21, 2026
A threat actor is reportedly offering a malware framework exploiting vulnerabilities in libsodium and NaCl. We analyze the risks to enterprise cryptographic integrity and provide mitigation steps.
June 18, 2026
An alleged zero-day exploitation framework targeting Windows 11 has emerged on underground forums. We analyze the technical implications and defense strategies.
The exploitation of IP PBX platforms involves a structured, multi-stage attack path. By analyzing the behaviors of threat groups like INJ3CTOR3, security researchers have mapped the lifecycle of these telephony compromises, demonstrating how a simple unauthenticated exploit leads to complex, deep system control.
The attack begins with automated network scanning. Malicious actors scan the public internet for exposed web administration interfaces of IP PBX platforms. Once a target is identified, the attacker launches the pre-authentication RCE exploit. In typical scenarios involving IP PBX frameworks, this exploit bypasses standard authentication checks and executes commands with the privileges of the web server user, such as asterisk or apache, granting immediate entry to the system's underlying shell.
Once initial execution is achieved, the exploit downloads and runs an initial stager script, typically written in Bash. A common file path used during this stage is /var/www/html/.clean.sh. This stager functions as a multi-stage dropper, pulling down more complex payloads from external command and control (C2) servers. The script is designed to establish an initial foothold and prepare the environment for long-term malware deployment.
To ensure exclusive control over the compromised IP PBX, the stager script executes aggressive defense evasion and competitor cleanup routines. It actively scans the file system for over 50 known competing web shell signatures deployed by rival threat groups. If any competing backdoors are identified, the stager deletes them immediately. It also modifies local firewall configurations to block competing C2 IP addresses and scrubs administrative logs (such as the secure log files) to hide traces of its own initial access.
Following the cleanup, the stager installs a highly obfuscated PHP backdoor known as the JOMANGY malware family. JOMANGY is designed to resist standard administrative cleanup attempts by utilizing six independent, self-healing persistence mechanisms that actively monitor and rebuild one another if any component is deleted:
Cron-based C2 Polling: A scheduled cron job is configured to poll the attacker's C2 server every one to three minutes to fetch new commands and verify that the backdoor is active.
Shell Profile Injections: The malware injects malicious commands into system shell profiles, such as .bash_profile, which execute automatically whenever an administrator or root user logs in or when the system reboots.
Immutable Crontab Backups: To prevent administrators from deleting the scheduled tasks, the malware saves a backup copy of the malicious crontab and applies the system's immutable attribute using the chattr +i command, making the file undeletable even by the root user.
Background Watchdog Process: A persistent background process runs continuously in memory, checking for the existence of the JOMANGY files. If a file is missing, the watchdog immediately rewrites it from memory.
Redundant PHP Hidden Backdoors: Multiple copies of the JOMANGY PHP script are placed in obscure system directories (such as subfolders within the phone provisioning paths), all protected with the chattr +i attribute.
Self-Reinstalling PHP Executor: A minimal PHP script acts as a secondary installation utility, triggered by web requests, designed to redeploy the entire backdoor infrastructure if the primary JOMANGY files are successfully removed.
In addition to these self-healing file mechanisms, the threat actors create up to 18 backdoor system accounts across the operating system. At least nine of these accounts are configured with root-level privileges (UID-0), allowing the adversaries to maintain full access even if all malicious web shell files are eradicated.
Unlike typical cyber espionage campaigns, the compromise of IP PBX platforms is heavily focused on financial monetization. Once root access is achieved, the threat actor pivots to telephony resources to orchestrate premium-rate call fraud.
By gaining control over the underlying Asterisk or FreePBX configurations, the attackers bypass call restrictions and compromise the organization's SIP (Session Initiation Protocol) trunks. The malware generates thousands of automated, high-volume calls to premium-rate international phone numbers controlled by the threat group. Because these outbound calls bypass standard billing limits, the victim enterprise is held liable for massive carrier toll charges, often amounting to tens of thousands of dollars within a few hours.
Beyond immediate toll fraud, a compromised IP PBX server serves as a trusted pivot point within the enterprise network. Because telephony servers must communicate with internal active directory environments, databases, and employee workstations, an attacker with root access on the PBX can launch lateral movement attacks. They can sniff internal network traffic, harvest credentials from configuration files (such as /etc/freepbx.conf), and target other sensitive assets within the perimeter.
A major security incident on a telephony system can also lead to regulatory compliance failures. Telecom networks often process sensitive personal data or handle customer service interactions. Under framework standards such as SOC 2 and PCI-DSS, leaving unpatched, unauthenticated RCE vulnerabilities open to compromise represents a significant control failure. Organizations operating in the GCC region face strict data governance standards, and a public breach originating from exposed communication infrastructure can trigger severe regulatory penalties.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
Defenders must utilize specific host-based and network-based signatures to detect the presence of JOMANGY or related IP PBX backdoors. Standard automated antivirus tools often fail to flag obfuscated PHP scripts, making manual threat hunting and log auditing essential.
To identify the rogue backdoor accounts created by the threat group, administrators should query the local system user database to find any accounts that have been assigned a User ID (UID) of 0, which grants them absolute administrative authority. Run the following command in the system terminal:
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 {print $1}'Verify each user account returned by this query against your authorized list of system administrators. Any unfamiliar account must be treated as an active indicator of compromise.
The malware uses the file system's immutable attribute to prevent administrators from modifying or deleting its components. To locate these locked files, use the system utility lsattr to list file attributes within the web directories. Execute this check to flag any file marked with the immutable attribute:
lsattr -R /var/www/html/ | grep "\-i\-"Legitimate web application files rarely require the immutable attribute, so any PHP, configuration, or shell script returned by this command should be investigated thoroughly.
Review the web server's access logs (such as Apache or Nginx logs) for unusual POST requests targeting core administrative endpoints. Pay close attention to calls to files like modular.php or /admin/config.php that lack valid authentication headers or originate from unexpected external IP addresses.
If a compromise of your IP PBX system is confirmed, immediate and decisive remediation actions are necessary to stop ongoing toll fraud and prevent re-infection.
As an immediate first step, isolate the administrative interface of the IP PBX from the public internet. Telephony consoles must never be directly accessible from the outside web. Move the management portal behind a secure VPN with multi-factor authentication, or restrict access to a highly controlled list of static IP addresses using strict network firewalls.
Because of JOMANGY's sophisticated six-layer self-healing persistence framework, manual deletion of identified malware files is rarely successful. If one script or process is left intact, the entire backdoor framework will rebuild itself. Therefore, the only reliable remediation method is to perform a complete operating system reinstall from trusted media. Once the system is reinstalled, restore configurations and databases only from verified, clean backups.
After rebuilding the server, perform a comprehensive secret rotation. This includes changing all administrative portal passwords, database access keys (specifically those found in configuration files), and all SIP trunk credentials. Ensure that any legacy, hard-coded, or default template credentials are permanently removed from the system configurations.