Shadowserver Finds About 900 FreePBX Instances Still Running Web Shells
Summary
Shadowserver reports about 900 FreePBX instances still run web shells, likely after exploitation of CVE-2025-64328. Fortinet linked the activity to INJ3CTOR3; users are advised to update the filestore module and restrict admin access.
Key points
- Shadowserver says approximately 900 FreePBX instances remain compromised and are running web shells; about 400 are in the US.
- The systems were likely compromised through CVE-2025-64328, a post-authentication command injection flaw in FreePBX’s filestore module.
- Fortinet reported that INJ3CTOR3 exploited the flaw to deploy the EncystPHP web shell, which supports remote command execution and persistent access.
- The flaw was patched in November 2025, and CISA added it to its Known Exploited Vulnerabilities list.
- Users are advised to update the filestore module, restrict administrative-panel access to authorized users, and block known malicious sources.
Article Details
- Event Type
- Ongoing compromise of Sangoma FreePBX instances following exploitation of vulnerabilities and deployment of web shells.
- Impact
- Approximately 900 FreePBX instances reportedly remain compromised and are running web shells. The shells enable remote command execution and persistent access. The article reports roughly 400 compromised instances in the US, with others in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands.
MITRE ATT&CK
CVE
CVE-2019-19006Sangoma · FreepbxA week later, the US cybersecurity agency CISA added the CVE to its Known Exploited Vulnerabilities (KEV) list alongside CVE-2019-19006, another FreePBX bug exploited by the same hacking group.CVE-2025-64328FreePBX · filestoreThe exploited bug, tracked as CVE-2025-64328 (CVSS score of 8.6) and patched in November 2025, impacts the filestore module of the endpoint manager’s administrative interface.
Threat Actors
Malware
Vendors
Products
AsteriskSangoma FreePBX is a web-based, open source graphical user interface that serves as a widely deployed management tool for Asterisk-based IP telephone systems.FreePBXApproximately 900 Sangoma FreePBX instances remain infected with web shells in attacks that exploited a command injection vulnerability starting December 2025.
Countries
BrazilDozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries.CanadaDozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries.FranceDozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries.GermanyDozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries.ItalyDozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries.NetherlandsDozens of instances are in Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands, and smaller numbers in many other countries.United StatesMost of the compromised instances (roughly 400) are in the US, data from The Shadowserver Foundation shows.