An underground threat actor is advertising a pre-authentication remote code execution (RCE) zero-day exploit targeting IP PBX software with over 10,000 active installations. Organizations using internet-exposed telephony systems must immediately secure their interfaces to prevent unauthorized administrative takeover.
Critical pre-authentication SQL injection and authentication bypass in FreePBX Endpoint module used for initial access.
Automated discovery of exposed web management portals.
Execution of pre-authentication RCE exploit (such as CVE-2025-57819) to bypass logins.
Bash stager script (`.clean.sh`) is downloaded to establish local execution foothold.
Deletes 50+ rival web shells, blocks competing C2 IPs, and scrubs security access logs.
Installs highly obfuscated JOMANGY PHP shell and seeds 18 backdoor OS accounts.
Bypasses trunk limits to place thousands of high-volume calls to premium-rate lines.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.