Hackers Attack FreePBX Servers With Malware to Steal SIP Credentials for Phone Fraud

What happened?

Hackers targeting FreePBX phone servers have upgraded their malware to steal credentials that can keep phone fraud running even after an infected system is rebuilt. The INJ3CTOR3 operation now collects configuration files containing SIP trunk passwords, database credentials, management secrets, and mail relay logins, extending the damage beyond the compromised server. The change builds on an earlier campaign that placed unauthorized calls through victims’ own phone systems.

Key details

• The updated INJ3CTOR3 malware harvests configuration files that hold SIP trunk passwords, database credentials, management secrets, and mail relay logins.
• Stolen SIP trunk credentials allow attackers to register from other devices and make calls that bypass the original PBX.
• The campaign continues using JOMANGY and ZenharR webshells to execute remote commands and control phone system functions.
• To recover, isolate the system, preserve evidence, eliminate persistence, then rotate all exposed credentials.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.