Hackers Use Six-Layer Persistence on FreePBX Systems

A financially motivated campaign attributed to INJ3CTOR3 is actively exploiting FreePBX systems using a multi-stage Bash dropper that installs JOMANGY and ZenharR webshells to enable VoIP toll fraud. The operation employs a six-layer persistence architecture, creates numerous backdoor accounts (including root-equivalent), uses identified C2 infrastructure (e.g., 45.234.176.202), and leverages likely vulnerabilities CVE-2025-64328 and CVE-2025-57819; hundreds of systems remain compromised months after patches.