The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May.  

It has since analyzed artifacts collected from the operator’s staging servers on 9 September 2026 and found that the implant now sends victims’ SIP trunk, AMI, database, and mail-relay credentials off the server. As a result, wiping an infected host no longer ends the fraud. 

INJ3CTOR3 has targeted Asterisk-based phone systems since at least 2020. That November, Check Point Research named the group for exploiting CVE-2019-19006 in FreePBX. Unit 42 linked it to attacks on Elastix in 2022, and Fortinet documented its EncystPHP webshell in January 2026. 

How JOMANGY Now Exfiltrates FreePBX Secrets 

The September version of the k.php script ends with two new base64-encoded lines. Each line holds 17 curl commands that upload configuration files from FreePBX, Issabel, and Elastix systems to /hima_data/index.php. 

Cron beacons rerun k.php every minute, so the theft repeats constantly. If a victim changes passwords while the system is still infected, the new passwords leak within minutes. With a stolen trunk secret, attackers can register with the carrier from anywhere and place calls that never touch the victim’s PBX. The only exception is when the carrier limits the trunk to the victim’s IP addresses.

The “hima” name matches a backdoor account the malware creates. It also matches a Telegram user Check Point spotted in 2020 sharing a tool that scanned and cracked SIP ranges.

Plain-text commands now point to 160[.]119[.]69[.]4, while base64-encoded commands still reach 45[.]95[.]147[.]178. The credential upload targets both hosts. Both hosts stopped responding in late September. CRIL is urging law enforcement agencies and national CERTs to work with hosting providers to preserve the server data and sinkhole the addresses.

INJ3CTOR3 Rotates the Indicators Defenders Relied On 

The core JOMANGY code is largely unchanged, but the identifiers defenders were told to hunt for have changed: 

• Watermark: The single April watermark (trace_e1ebf9066a951be519a24140711839ea) has been replaced by per-build values: trace_bd42a8a0d23ae16c85dede7d2abaec05 and trace_7544725ebaaadac217dfaa7ca8e8fe7e. 
• Gate hash: The MD5 gate hash shared by JOMANGY and ZenharR moved from a2f6863413c4192a4abfa360577b9961 to 8b3a1d970fda0c17a0b785a990fb7b6a. 
• Takeover script: The /x script grew from 367 to 620 lines, mostly to remove rival actors’ implants and SSH keys. 

The panel can also forge a FreePBX admin session through the ampuser class and setAdmin(). This means changing the admin password does not lock the attacker out. 

Hidden Doors in Compromised FreePBX Systems 

The malware plants an .htaccess file in /var/www/html/admin/views/. It routes any request containing an encoded space or tab, such as %20 or %09, to config.php. Access logs record only the requested path, never the webshell’s filename, so searching logs for the shell by name can come up empty. 

Trunks written directly to /etc/asterisk files such as pjsip_custom.conf also stay invisible in the FreePBX console. Administrators should audit through Asterisk CLI commands such as pjsip show endpoints and compare the results with what the console lists. 

Cleaning Up After INJ3CTOR3 

Shadowserver counted more than 900 compromised FreePBX instances in February 2026, and over 700 were still infected in May. Sangoma’s patch for CVE-2025-57819 blocks new exploitation but does not clean systems that are already compromised. 

CRIL recommends this order: 

1. Isolate the host from the internet. 
2. Preserve crontabs, logs, and the ampusers table. 
3. Remove the cron entries and the zen2 watchdog. 
4. Delete the eight crontab backups and the login stagers. 
5. Remove extra UID-0 accounts and accounts with $1$nRz1Cbtk$ password hashes. 
6. Delete the 12 webshell copies and the freepbxusers row. 
7. Only then, rotate credentials across all 17 files. 

CRIL’s report-only beagle.sh script can help with triage. Because the operator keeps rotating hashes and hosts, detection based on behavior and file origin will outlast hunting for specific hashes. 

The first half of 2026 reinforced a familiar reality in ransomware: a small number of highly capable operators continue to drive a disproportionate share of global attacks. Among them, Qilin ransomware emerged as the most active threat group tracked by Cyble Research and Intelligence Labs (CRIL), demonstrating the scale and reach of today’s ransomware-as-a-service (RaaS) ecosystem. CRIL observed Qilin targeting organizations across multiple regions and industries, with activity spanning North America, Europe, Asia-Pacific, South America, and other global markets. Its widespread campaigns highlight how modern ransomware groups leverage affiliate networks, purchased access, and proven extortion techniques to maintain sustained operational momentum.

Download the Cyble H1 2026 Cyber Threat Landscape Report for the full analysis.

Breaking Down the Qilin Ransomware Operation 

Qilin’s activity was particularly significant in North America, where the group accounted for 370 ransomware attacks during H1 2026. This represented nearly one-fifth of all ransomware incidents recorded in the region. The group also maintained a strong presence in Europe and the UK, claiming 158 attacks, while Asia-Pacific recorded 64 incidents linked to Qilin. In South America, the group was responsible for 40 attacks, further demonstrating its ability to operate across diverse geographic environments. Rather than concentrating on a single market, Qilin followed a broad targeting strategy designed to maximize opportunities across industries. 

Targeting Sectors Where Downtime Hurts Most 

Qilin’s victim profile reflected a common ransomware strategy: focusing on organizations where operational disruption creates immediate pressure.  Manufacturing organizations remain especially attractive because ransomware incidents can interrupt production lines and affect supply chains. Healthcare organizations face additional pressure due to the critical nature. Construction, Healthcare, and Professional Services were among the sectors most frequently targeted. These industries often depend on continuous availability, hold sensitive information, and face significant financial or regulatory consequences when systems are disrupted.  Manufacturing organizations remain especially attractive because ransomware incidents can interrupt production lines and affect supply chains. Healthcare organizations face additional pressure due to the critical nature of their services and the sensitivity of patient information.  Professional Services firms, including legal and consulting organizations, also represent valuable targets because they manage confidential client data that can increase the impact of double-extortion campaigns. 

The RaaS Model Behind Qilin’s Growth 

Qilin’s success reflects the maturity of the ransomware-as-a-service model. Instead of relying on a single internal team to handle every stage of an attack, RaaS groups operate through specialized ecosystems that include affiliates, initial access brokers, and other underground service providers.  This structure allows ransomware brands to expand quickly, launch simultaneous campaigns, and maintain activity even as individual operators face disruption. The continued success of groups like Qilin shows why ransomware remains difficult to contain. Law enforcement actions and infrastructure takedowns can affect individual operations, but decentralized affiliate models allow new campaigns to continue.

Defending Against the Qilin Threat 

The group’s activity reinforces several priorities for organizations: reducing exposed attack surfaces, strengthening identity controls, monitoring suspicious access activity, and preparing for data theft alongside encryption.  Since ransomware operators increasingly rely on stolen credentials and compromised infrastructure, security programs must focus on preventing initial access as much as responding to active attacks. 

To explore Qilin’s attack patterns, global ransomware trends, targeted industries, and the broader threat landscape observed in H1 2026, download the complete Cyble H1 2026 Cyber Threat Landscape Report.