INJ3CTOR3
INJ3CTOR3 is a threat actor first identified in 2020, known for targeting vulnerabilities in VoIP systems, specifically CVE-2019-19006 and CVE-2021-45461. Their operations involve exploiting FreePBX vulnerabilities to deploy PHP web shells for data exfiltration and persistence. The group utilizes tools for SIP server exploitation, including brute-force scripts and authentication bypass techniques. Observations indicate a resurgence of their attack patterns, reflecting historical behaviors while adapting to current vulnerabilities.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- Cyble reveals how INJ3CTOR3 FreePBX malware steals 17 config files every minute. The JOMANGY INJ3CTOR3 FreePBX malware enables off-box toll fraud. # INJ3CTOR3 #mastodon · Oct 30, 2026
- INJ3CTOR3 Malware Steals FreePBX Credentials to Enable Fraudulent Calls Even After Server Cleanup The INJ3CTOR3 malware has expanded its FreePBX toll-fraud campmastodon · Oct 29, 2026
- INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup https:// thecyberexpress.com/inj3ctor3- jomangy-freepbx-credential-theft/mastodon · Oct 28, 2026
References
- https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/
- https://unit42.paloaltonetworks.com/digium-phones-web-shell/
- https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.