Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

guest · Jul 17, 2022

July 15, 2022

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads.

"The malware installs multilayer obfuscated PHP backdoors to the web server's file system, downloads new payloads for execution, and schedules recurring tasks to re-infect the host system," Palo Alto Networks Unit 42 said in a Friday report.
Unit 42 said the intrusions share similarities with the INJ3CTOR3 campaign that Israeli cybersecurity firm Check Point disclosed in November 2020, alluding to the possibility that they could be a "resurgence" of the previous attacks.
Click to expand...

Besides taking measures to cover its tracks, the malware is also equipped to run arbitrary commands, ultimately allowing the hackers to take control of the system, steal information, while also maintaining a backdoor to the compromised hosts.

"The strategy of implanting web shells in vulnerable servers is not a new tactic for malicious actors," the researchers said, adding it's a "common approach malware authors take to launch exploits or run commands remotely."
Click to expand...

Palo Alto Networks - Unit42: Digium Phones Under Attack: Insight Into the Web Shell Implant

Installing a web shell on a web server is a common approach malware authors take to launch exploits or run commands remotely. In November 2020, the INJ3CTOR3 operation targeted the Sangoma PBX, a popular VoIP PBX system, by installing a web shell on its web server. Recently, Unit 42 observed another operation that targets the Elastix system used in Digium phones.

The attacker implants a web shell to exfiltrate data by downloading and executing additional payloads inside the target's Digium phone software (a FreePBX module written in PHP). In terms of the timeline, the web shell appears to be correlated to the remote code execution (RCE) vulnerability CVE-2021-45461 in the Rest Phone Apps (restapps) module.
Click to expand...

As of this writing, we have witnessed more than 500,000 unique malware samples of this family over the period spanning from late December 2021 till the end of March 2022.
Click to expand...

Log in or Sign up

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

guest Guest

Log in or Sign up

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

guest Guest

Useful Searches