Loading story…
Attackers have been exploiting CVE-2025-64328, a post-authentication command injection flaw in the Sangoma FreePBX Endpoint Manager (filestore component) to compromise internet-exposed FreePBX systems and deploy persistent web shells. The vulnerability affects FreePBX versions 17.0.2.36 and above prior to 17.0.3, and can be abused by an authenticated user via the testconnection -> check_ssh_connect() function to execute commands and gain remote access as the asterisk user; the issue is fixed in 17.0.3. Reporting indicates the activity began in December 2025 and has left hundreds of systems persistently backdoored with web shells.
The Shadowserver Foundation reported roughly 900 FreePBX instances still compromised, with the largest concentration in the United States (about 400) and additional impacted systems across Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands. Fortinet/FortiGuard Labs identified a PHP web shell dubbed EncystPHP associated with the campaign, which supports remote command execution, persistence, and additional web shell deployment; follow-on risk includes VoIP-focused abuse such as outbound call fraud and potential network pivoting from the PBX host. One source also states the vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, reinforcing the need for rapid patching and incident response on exposed FreePBX deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By late February 2026, the Shadowserver Foundation reported roughly 900 internet-facing Sangoma FreePBX instances remained compromised, with the largest concentration in the United States and additional victims across Europe and the Americas. The findings showed the campaign had achieved broad and persistent access months after exploitation began.
CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalog in early February 2026 after evidence of active exploitation in the wild. The listing signaled federal recognition of the flaw as an actively exploited risk requiring remediation.
Following exploitation, attackers deployed PHP web shells including EncystPHP to establish persistence on compromised FreePBX servers. Fortinet linked the activity to a threat actor it tracks as INJ3CTOR3 and described follow-on actions such as credential harvesting, account and cron changes, SSH key injection, and removal of competing shells.
Threat actors started exploiting the post-authentication command injection flaw CVE-2025-64328 in Sangoma FreePBX Endpoint Manager in early December 2025. The exploitation was used to gain command execution on exposed FreePBX systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcerescana.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A financially motivated threat actor tracked as **INJ3CTOR3** has been observed exploiting **CVE-2025-64328**, a post-authentication command-injection flaw in the *FreePBX Endpoint Manager* administrative interface, to deploy a persistent PHP web shell dubbed **EncystPHP**. The activity began in early December 2025 and enables attackers to execute arbitrary commands (as the `asterisk` user) and progress to full administrative control of compromised VoIP environments, supporting follow-on abuse such as unauthorized call generation and toll fraud. FortiGuard Labs reported the campaign’s infrastructure and delivery chain, including downloads of an EncystPHP dropper from `45[.]234[.]176[.]202` (domain `crm[.]razatelefonia[.]pro`), a site masquerading as a VoIP management portal with a login page; requests to the `new/` path reportedly redirect to an additional dropper (`k.php`). The observed exploitation traffic originated from Brazil and targeted an environment managed by an Indian technology services provider; affected versions were reported as *FreePBX Endpoint Manager* `v17.0.2.36` through `v17.0.3`, and the web shell was described as “weaponized,” with remote command execution and persistence mechanisms. Reporting also links the activity to INJ3CTOR3’s historical pattern of targeting VoIP platforms, including prior exploitation of **CVE-2019-19006** (FreePBX) and **CVE-2021-45461** (Elastix).
Jun 29, 2026
Reporting highlights two separate developments: growing criminal adoption of **Vshell**, a Go-based command-and-control framework originally promoted in Chinese-speaking offensive security communities as a lower-cost alternative to *Cobalt Strike*. Research cited in the reporting describes Vshell’s evolution from a basic RAT into a more capable post-compromise platform supporting Windows and Linux administration, traffic tunneling/relay, pivoting, and lateral movement; internet scanning also identified exposed Vshell management panels with large numbers of connected agents (e.g., a recovered panel showing **286 active clients**), indicating real-world operational use. Separately, the **Shadowserver Foundation** reported that **900+ Sangoma FreePBX** instances remain infected with web shells following exploitation of **CVE-2025-64328** (CVSS 8.6), a post-authentication command-injection flaw affecting FreePBX versions `>= 17.0.2.36` and fixed in `17.0.3`. The issue has been added to **CISA’s KEV** catalog amid active exploitation, and Fortinet linked exploitation beginning in December 2025 to the **INJ3CTOR3** cyber-fraud operation delivering an `EncystPHP` web shell; recommended mitigations include restricting access to the FreePBX Admin Control Panel (ACP) and updating affected components (including the *filestore* module).
Jun 29, 2026
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026