INJ3CTOR3 Exploits FreePBX CVE-2025-64328 to Deploy EncystPHP Web Shell

A financially motivated threat actor tracked as INJ3CTOR3 has been observed exploiting CVE-2025-64328, a post-authentication command-injection flaw in the FreePBX Endpoint Manager administrative interface, to deploy a persistent PHP web shell dubbed EncystPHP. The activity began in early December 2025 and enables attackers to execute arbitrary commands (as the asterisk user) and progress to full administrative control of compromised VoIP environments, supporting follow-on abuse such as unauthorized call generation and toll fraud.

FortiGuard Labs reported the campaign’s infrastructure and delivery chain, including downloads of an EncystPHP dropper from 45[.]234[.]176[.]202 (domain crm[.]razatelefonia[.]pro), a site masquerading as a VoIP management portal with a login page; requests to the new/ path reportedly redirect to an additional dropper (k.php). The observed exploitation traffic originated from Brazil and targeted an environment managed by an Indian technology services provider; affected versions were reported as FreePBX Endpoint Manager v17.0.2.36 through v17.0.3, and the web shell was described as “weaponized,” with remote command execution and persistence mechanisms. Reporting also links the activity to INJ3CTOR3’s historical pattern of targeting VoIP platforms, including prior exploitation of CVE-2019-19006 (FreePBX) and CVE-2021-45461 (Elastix).