Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Digium Phones Under Attack: Insight Into the Web Shell Implant

Summary: Unit 42 observed an operation implanting a web shell in the Digium phones FreePBX module on Elastix systems, tied to the Rest Phone Apps remote code execution vulnerability CVE-2021-45461, and recorded more than 500,000 unique malware samples between late December 2021 and the end of March 2022. The dropper is a 14-line shell script wrapped in multiple layers of Base64 encoding that installs obfuscated PHP backdoors, downloads new payloads, schedules recurring re-infection tasks, and spoofs file timestamps to blend in, with one variant fetching a remote script from an IP address geolocated in the Netherlands.

Bottom line: More than 500,000 unique samples in roughly three months against open source Asterisk-based VoIP systems means the phone system many organizations treat as background infrastructure is an active target, and the malware's junk-string padding and timestamp spoofing are built specifically to slip past signature and IoC defenses.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2021-45461
Related