Hackers Use Six

Gbhackers •Mayura Kathir • May 22, 2026

Hackers are actively exploiting FreePBX systems using a highly resilient six-layer persistence mechanism. The campaign has been attributed with high confidence to the threat actor INJ3CTOR3, known for targeting VoIP infrastructure for financial gain since 2019. The operation deploys a multi-stage Bash dropper that installs a previously undocumented PHP webshell family named JOMANGY, alongside the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

INJ3CTOR3 Targets FreePBX Systems with JOMANGY Webshell and VoIP Toll Fraud A cyber campaign attributed to the threat actor INJ3CTOR3 is targeting FreePBX systems, deploying a new PHP webshell named JOMANGY. This operation utilizes a six-layer persistence mechanism to maintain control over compromised systems, allowing attackers to exploit victims' SIP trunks for fraudulent VoIP calls. The campaign has introduced 18 backdoor accounts, nine of which have root-level access, making detection challenging. Researchers from Cyble Research & Intelligence Labs (CRIL) have linked this activity to previous operations involving the ZenharR malware toolkit. The attack leverages vulnerabilities such as CVE-2025-64328 and CVE-2025-57819 to gain initial access. The scope of impact is global, with a significant focus on systems hosted on Alibaba Cloud. Current remediation efforts are largely ineffective due to the self-healing nature of the malware. 5 sources 71

Extracted Entities

Hackers Use Six

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)