Hackers Use Six-Layer Persistence to Maintain Access on Compromised FreePBX Systems

The report describes an active INJ3CTOR3 campaign exploiting FreePBX vulnerabilities to deploy the JOMANGY PHP webshell that uses six interdependent persistence mechanisms and multiple backdoor accounts to maintain long-term access and route toll-fraud calls; researchers tracked thousands of targets, hundreds of infected hosts, and published detailed IoCs and remediation guidance advising full rebuilds of compromised systems.