Malware
EncystPHP
- First Reported
- Feb 27, 2026
- Latest Reported
- Feb 28, 2026
Reported Context (2)
- Fortinet links the intrusions to threat actor INJ3CTOR3 delivering the EncystPHP web shell, which enables arbitrary command execution and outbound PBX call activity; organizations are urged to update to FreePBX 17.0.3, Over 900 Sangoma FreePBX Instances Remain Infected in Ongoing Attacks
- Last month, Fortinet revealed that a hacking group tracked as INJ3CTOR3 had been exploiting CVE-2025-64328 for over a month to deploy a web shell called EncystPHP. Shadowserver Finds About 900 FreePBX Instances Still Running Web Shells
CVE (2)
Threat Actors (1)
MITRE ATT&CK (2)
Vendors (1)
Products (2)
Countries (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.