Nahda

Nahda is a criminal threat actor associated with compromises of internet-exposed FreePBX and related VoIP platforms. The actor is identified in intrusion-cleanup logic used by a competing VoIP fraud operation, which explicitly removed Nahda-associated user accounts and artifacts from infected systems, indicating Nahda was one of several groups competing for persistent control of vulnerable PBX environments. Known associated account names include nahda and FreePBX_setup. Nahda is linked to activity in the VoIP fraud ecosystem, particularly operations that abuse compromised telephony infrastructure for unauthorized call origination and related toll-fraud schemes. The actor’s tradecraft, as evidenced by rival-removal behavior targeting its implants, indicates use of persistence on compromised PBX hosts through local account creation and likely web-based access mechanisms common to FreePBX intrusions. Nahda appears to operate as part of a broader cluster of criminal actors targeting FreePBX, Elastix, Issabel, and Sangoma systems for exclusive access to SIP trunks and administrative control. The name Nahda is Arabic for “renaissance,” and the observed naming conventions suggest a possible Middle Eastern nexus; however, this attribution is not established at high confidence. No specific country of origin can be confirmed from the available facts.