Loading story…
Reporting highlights two separate developments: growing criminal adoption of Vshell, a Go-based command-and-control framework originally promoted in Chinese-speaking offensive security communities as a lower-cost alternative to Cobalt Strike. Research cited in the reporting describes Vshell’s evolution from a basic RAT into a more capable post-compromise platform supporting Windows and Linux administration, traffic tunneling/relay, pivoting, and lateral movement; internet scanning also identified exposed Vshell management panels with large numbers of connected agents (e.g., a recovered panel showing 286 active clients), indicating real-world operational use.
Separately, the Shadowserver Foundation reported that 900+ Sangoma FreePBX instances remain infected with web shells following exploitation of CVE-2025-64328 (CVSS 8.6), a post-authentication command-injection flaw affecting FreePBX versions >= 17.0.2.36 and fixed in 17.0.3. The issue has been added to CISA’s KEV catalog amid active exploitation, and Fortinet linked exploitation beginning in December 2025 to the INJ3CTOR3 cyber-fraud operation delivering an EncystPHP web shell; recommended mitigations include restricting access to the FreePBX Admin Control Panel (ACP) and updating affected components (including the filestore module).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Censys found numerous exposed Vshell deployments on the internet, including management panels showing hundreds of connected agents and broadly distributed listener infrastructure. The findings highlighted growing operational use of Vshell and its increasing visibility across attacker-controlled systems.
The Shadowserver Foundation reported that more than 900 Sangoma FreePBX instances remained compromised with web shells as of late February 2026. The largest number of infected systems was in the United States, with additional victims in Brazil, Canada, Germany, and France.
Fortinet FortiGuard Labs attributed exploitation of CVE-2025-64328 to the INJ3CTOR3 cyber fraud operation. The activity involved deployment of the EncystPHP web shell, which can execute elevated commands and initiate outbound calls through compromised PBX systems.
CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalog after observing active exploitation in the wild. This formalized the vulnerability's status as an actively exploited security issue.
During 2025, Vshell was identified in several threat campaigns, including Operation DRAGONCLONE, the SNOWLIGHT campaign attributed to UNC5174, and an August 2025 phishing operation. These sightings indicated the framework had moved beyond opportunistic use into broader threat actor adoption.
Sangoma addressed CVE-2025-64328 in FreePBX version 17.0.3. The issue affected version 17.0.2.36 and later, and mitigation guidance included hardening access to the Administrator Control Panel and updating the filestore module.
Attackers began exploiting CVE-2025-64328 against Sangoma FreePBX instances in December 2025, leading to widespread web shell compromises. The flaw is a high-severity post-authentication command injection vulnerability that enables arbitrary shell command execution.
Vshell, a Go-based command-and-control framework, first appeared in 2021 in Chinese-speaking offensive security circles. It began as a basic remote access tool and later evolved into a more capable intrusion framework.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have been exploiting **CVE-2025-64328**, a post-authentication command injection flaw in the *Sangoma FreePBX Endpoint Manager* (filestore component) to compromise internet-exposed FreePBX systems and deploy persistent web shells. The vulnerability affects FreePBX versions `17.0.2.36` and above prior to `17.0.3`, and can be abused by an authenticated user via the `testconnection -> check_ssh_connect()` function to execute commands and gain remote access as the `asterisk` user; the issue is fixed in **17.0.3**. Reporting indicates the activity began in **December 2025** and has left hundreds of systems persistently backdoored with web shells. The **Shadowserver Foundation** reported roughly **900** FreePBX instances still compromised, with the largest concentration in the **United States** (about **400**) and additional impacted systems across **Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands**. Fortinet/FortiGuard Labs identified a PHP web shell dubbed **EncystPHP** associated with the campaign, which supports remote command execution, persistence, and additional web shell deployment; follow-on risk includes VoIP-focused abuse such as **outbound call fraud** and potential network pivoting from the PBX host. One source also states the vulnerability has been added to **CISA’s Known Exploited Vulnerabilities (KEV) Catalog**, reinforcing the need for rapid patching and incident response on exposed FreePBX deployments.
Jun 29, 2026
A financially motivated threat actor tracked as **INJ3CTOR3** has been observed exploiting **CVE-2025-64328**, a post-authentication command-injection flaw in the *FreePBX Endpoint Manager* administrative interface, to deploy a persistent PHP web shell dubbed **EncystPHP**. The activity began in early December 2025 and enables attackers to execute arbitrary commands (as the `asterisk` user) and progress to full administrative control of compromised VoIP environments, supporting follow-on abuse such as unauthorized call generation and toll fraud. FortiGuard Labs reported the campaign’s infrastructure and delivery chain, including downloads of an EncystPHP dropper from `45[.]234[.]176[.]202` (domain `crm[.]razatelefonia[.]pro`), a site masquerading as a VoIP management portal with a login page; requests to the `new/` path reportedly redirect to an additional dropper (`k.php`). The observed exploitation traffic originated from Brazil and targeted an environment managed by an Indian technology services provider; affected versions were reported as *FreePBX Endpoint Manager* `v17.0.2.36` through `v17.0.3`, and the web shell was described as “weaponized,” with remote command execution and persistence mechanisms. Reporting also links the activity to INJ3CTOR3’s historical pattern of targeting VoIP platforms, including prior exploitation of **CVE-2019-19006** (FreePBX) and **CVE-2021-45461** (Elastix).
Jun 29, 2026
Rapid7 released new *Metasploit Framework* content adding multiple modules that weaponize a **FreePBX** vulnerability chain starting with **CVE-2025-66039** (authentication bypass) to enable unauthenticated attackers to reach **remote code execution (RCE)**. The modules, authored by **Noah King** and **msutovsky-r7**, demonstrate how an initial auth bypass can be combined with follow-on flaws to move from external access to full system compromise. The new FreePBX modules include an exploit that chains **CVE-2025-66039** with **CVE-2025-61675** (SQL injection) to insert a malicious job into the `cron_job` database table and execute arbitrary code, plus an auxiliary module using the same SQLi path to create a rogue administrator account. A second exploit chains **CVE-2025-66039** with **CVE-2025-61678** (unrestricted firmware file upload) to place a webshell on the server for RCE. Separate reporting also notes the same Metasploit update introduced additional exploit modules affecting other enterprise software (including *Cacti* and *SmarterMail*), but the detailed technical coverage in the sources focuses primarily on the FreePBX chaining approach and module implementations (e.g., `unix/http/freepbx_custom_extension_rce` and `unix/http/freepbx_firmware_file_upload`).
Jun 29, 2026