actively-exploited-vulnerabilitygovernment-vulnerability-cataloginternet-exposed-servicepersistence-method

Mass Exploitation of Sangoma FreePBX CVE-2025-64328 to Deploy EncystPHP Web Shells

Active Exploitation · 3 sources · Updated 4mo ago · First seen Mar 1, 2026

Attackers have been exploiting CVE-2025-64328, a post-authentication command injection flaw in the Sangoma FreePBX Endpoint Manager (filestore component) to compromise internet-exposed FreePBX systems and deploy persistent web shells. The vulnerability affects FreePBX versions 17.0.2.36 and above prior to 17.0.3, and can be abused by an authenticated user via the testconnection -> check_ssh_connect() function to execute commands and gain remote access as the asterisk user; the issue is fixed in 17.0.3. Reporting indicates the activity began in December 2025 and has left hundreds of systems persistently backdoored with web shells.

The Shadowserver Foundation reported roughly 900 FreePBX instances still compromised, with the largest concentration in the United States (about 400) and additional impacted systems across Brazil, Canada, Germany, France, the UK, Italy, and the Netherlands. Fortinet/FortiGuard Labs identified a PHP web shell dubbed EncystPHP associated with the campaign, which supports remote command execution, persistence, and additional web shell deployment; follow-on risk includes VoIP-focused abuse such as outbound call fraud and potential network pivoting from the PBX host. One source also states the vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, reinforcing the need for rapid patching and incident response on exposed FreePBX deployments.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Dec 1, 2025 – Feb 28, 2026

Feb 28, 20268mo ago
Shadowserver reports about 900 FreePBX instances still compromised
By late February 2026, the Shadowserver Foundation reported roughly 900 internet-facing Sangoma FreePBX instances remained compromised, with the largest concentration in the United States and additional victims across Europe and the Americas. The findings showed the campaign had achieved broad and persistent access months after exploitation began.
Feb 1, 20269mo ago
CISA adds CVE-2025-64328 to the KEV catalog
CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalog in early February 2026 after evidence of active exploitation in the wild. The listing signaled federal recognition of the flaw as an actively exploited risk requiring remediation.
Dec 1, 202511mo ago
Web shell campaign compromises hundreds of FreePBX servers
Following exploitation, attackers deployed PHP web shells including EncystPHP to establish persistence on compromised FreePBX servers. Fortinet linked the activity to a threat actor it tracks as INJ3CTOR3 and described follow-on actions such as credential harvesting, account and cron changes, SSH key injection, and removal of competing shells.
Dec 1, 202511mo ago
Attackers begin exploiting CVE-2025-64328 against FreePBX
Threat actors started exploiting the post-authentication command injection flaw CVE-2025-64328 in Sangoma FreePBX Endpoint Manager in early December 2025. The exploitation was used to gain command execution on exposed FreePBX systems.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Authenticated Command Injection in Sangoma FreePBX Filestore (CVE-2025-64328)

Threat actors

1 linked

INJ3CTOR3

Malware

1 linked

EncystPHP

Affected products

3 linked

FreepbxFreepbxFreepbx

Organizations

1 linked

Sangoma Technologies Corporation

Observables

2 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

ScworldNews · Mar 2, 2026

Hundreds of FreePBX instances infected by web shells exploiting command injection vulnerability | brief | SC MediaOpen source ↗

Security AffairsNews · Mar 1, 2026

CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instancesOpen source ↗

Rescana BlogNews · Mar 1, 2026

Ongoing Cyberattack Exploits Sangoma FreePBX CVE-2025-64328: Over 900 Instances Compromised by Web ShellsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilitygovernment-vulnerability-cataloginternet-exposed-servicepersistence-method

Mass Exploitation of Sangoma FreePBX CVE-2025-64328 to Deploy EncystPHP Web Shells

Active Exploitation · 3 sources · Updated 4mo ago · First seen Mar 1, 2026

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Dec 1, 2025 – Feb 28, 2026

Feb 28, 20268mo ago
Shadowserver reports about 900 FreePBX instances still compromised
By late February 2026, the Shadowserver Foundation reported roughly 900 internet-facing Sangoma FreePBX instances remained compromised, with the largest concentration in the United States and additional victims across Europe and the Americas. The findings showed the campaign had achieved broad and persistent access months after exploitation began.
Feb 1, 20269mo ago
CISA adds CVE-2025-64328 to the KEV catalog
CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalog in early February 2026 after evidence of active exploitation in the wild. The listing signaled federal recognition of the flaw as an actively exploited risk requiring remediation.
Dec 1, 202511mo ago
Web shell campaign compromises hundreds of FreePBX servers
Following exploitation, attackers deployed PHP web shells including EncystPHP to establish persistence on compromised FreePBX servers. Fortinet linked the activity to a threat actor it tracks as INJ3CTOR3 and described follow-on actions such as credential harvesting, account and cron changes, SSH key injection, and removal of competing shells.
Dec 1, 202511mo ago
Attackers begin exploiting CVE-2025-64328 against FreePBX
Threat actors started exploiting the post-authentication command injection flaw CVE-2025-64328 in Sangoma FreePBX Endpoint Manager in early December 2025. The exploitation was used to gain command execution on exposed FreePBX systems.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →