JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign

Cyble Research & Intelligence Labs documents an active INJ3CTOR3 FreePBX campaign that deploys a multi-stage Bash dropper and a newly described PHP webshell family (JOMANGY) alongside ZenharR to enable VoIP toll fraud; the implants use double-layer obfuscation, carry a consistent watermark, establish six mutually reinforcing persistence channels (cron polling, shell-profile stagers, immutable crontab backups, process watchdogs, chattr-protected webshell copies, and a PHP executor), plant 18 backdoor accounts (including nine UID-0), and are assessed to have been distributed across a C2-hosted inventory of 3,080 addresses with active exploitation and significant remediation challenges.