VictamPbx FreePBX Malware Hijacks PBX Systems for Toll Fraud

Breakglass Intelligence reported a financially motivated campaign targeting internet-exposed FreePBX, Elastix, Issabel, and related Asterisk-based VoIP systems with malware disguised as k.php. The malware exploits the FreePBX restapps REST API for remote code execution, deploys the VictamPbx PHP webshell across multiple PBX web paths, steals administrator credentials, hijacks admin sessions, and enables outbound call origination to abuse victim SIP trunks for International Revenue Share Fraud (IRSF). Researchers observed at least 17 closely related variants and linked repeated payload delivery to infrastructure centered on 45.234.176.202 in Salvador, Bahia, Brazil, alongside branding and backend services associated with VictamPbx, emoadmin, emo, and Raza Telefonia.

The newest variant expanded beyond fraud enablement by aggressively securing exclusive access to compromised systems. Its Stage 2 payload established persistence through root-level accounts, SSH keys, cron jobs, and boot/login mechanisms, while also disabling the endpoint module, scrubbing Apache logs, timestomping files, and removing implants, accounts, cron entries, and webshells tied to at least seven rival VoIP threat actors, including Juba VoIP, Nahda, Badr/b3d0r, nvd0rz, tchTowr, and yokyok. Breakglass assessed the activity as a Brazilian or Brazilian-affiliated operation that has likely been active since at least 2023, with the latest samples showing a territorial fight among criminal groups for exclusive control of vulnerable PBX infrastructure.