actively-exploited-vulnerabilitygovernment-vulnerability-catalogoffensive-tooling-releasethreat-infrastructure-tracking

Vshell C2 Framework Adoption and FreePBX Web Shell Compromises via CVE-2025-64328

Active Exploitation · 2 sources · Updated 4mo ago · First seen Mar 1, 2026

Reporting highlights two separate developments: growing criminal adoption of Vshell, a Go-based command-and-control framework originally promoted in Chinese-speaking offensive security communities as a lower-cost alternative to Cobalt Strike. Research cited in the reporting describes Vshell’s evolution from a basic RAT into a more capable post-compromise platform supporting Windows and Linux administration, traffic tunneling/relay, pivoting, and lateral movement; internet scanning also identified exposed Vshell management panels with large numbers of connected agents (e.g., a recovered panel showing 286 active clients), indicating real-world operational use.

Separately, the Shadowserver Foundation reported that 900+ Sangoma FreePBX instances remain infected with web shells following exploitation of CVE-2025-64328 (CVSS 8.6), a post-authentication command-injection flaw affecting FreePBX versions >= 17.0.2.36 and fixed in 17.0.3. The issue has been added to CISA’s KEV catalog amid active exploitation, and Fortinet linked exploitation beginning in December 2025 to the INJ3CTOR3 cyber-fraud operation delivering an EncystPHP web shell; recommended mitigations include restricting access to the FreePBX Admin Control Panel (ACP) and updating affected components (including the filestore module).

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jan 1, 2021 – Feb 27, 2026

Feb 27, 20269mo ago
Censys identifies widespread internet-facing Vshell infrastructure
Censys found numerous exposed Vshell deployments on the internet, including management panels showing hundreds of connected agents and broadly distributed listener infrastructure. The findings highlighted growing operational use of Vshell and its increasing visibility across attacker-controlled systems.
Feb 27, 20269mo ago
Shadowserver reports 900+ FreePBX instances still infected
The Shadowserver Foundation reported that more than 900 Sangoma FreePBX instances remained compromised with web shells as of late February 2026. The largest number of infected systems was in the United States, with additional victims in Brazil, Canada, Germany, and France.
Feb 27, 20269mo ago
Fortinet links FreePBX exploitation to INJ3CTOR3 operation
Fortinet FortiGuard Labs attributed exploitation of CVE-2025-64328 to the INJ3CTOR3 cyber fraud operation. The activity involved deployment of the EncystPHP web shell, which can execute elevated commands and initiate outbound calls through compromised PBX systems.
Feb 27, 20269mo ago
CISA adds CVE-2025-64328 to the KEV catalog
CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalog after observing active exploitation in the wild. This formalized the vulnerability's status as an actively exploited security issue.
Dec 31, 202510mo ago
Vshell observed in multiple 2025 threat campaigns
During 2025, Vshell was identified in several threat campaigns, including Operation DRAGONCLONE, the SNOWLIGHT campaign attributed to UNC5174, and an August 2025 phishing operation. These sightings indicated the framework had moved beyond opportunistic use into broader threat actor adoption.
Dec 1, 202511mo ago
Sangoma fixes CVE-2025-64328 in FreePBX 17.0.3
Sangoma addressed CVE-2025-64328 in FreePBX version 17.0.3. The issue affected version 17.0.2.36 and later, and mitigation guidance included hardening access to the Administrator Control Panel and updating the filestore module.
Dec 1, 202511mo ago
Attacks exploiting CVE-2025-64328 begin against Sangoma FreePBX
Attackers began exploiting CVE-2025-64328 against Sangoma FreePBX instances in December 2025, leading to widespread web shell compromises. The flaw is a high-severity post-authentication command injection vulnerability that enables arbitrary shell command execution.
Jan 1, 20216y ago
Vshell emerges in Chinese-speaking offensive security communities
Vshell, a Go-based command-and-control framework, first appeared in 2021 in Chinese-speaking offensive security circles. It began as a basic remote access tool and later evolved into a more capable intrusion framework.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Authenticated Command Injection in Sangoma FreePBX Filestore (CVE-2025-64328)

Affected products

3 linked

FreepbxFreepbxFreepbx

Organizations

1 linked

Sangoma Technologies Corporation

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Feb 27, 2026

Vshell Gains Traction Among Threat Actors as an Alternative to Cobalt StrikeOpen source ↗

The Hacker NewsNews · Feb 27, 2026

900+ Sangoma FreePBX Instances Compromised in Ongoing Web Shell AttacksOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News