Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
19 IOCs
From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves
Excerpt
Executive Summary In May, Cyble Research & Intelligence Labs (CRIL) documented JOMANGY , a PHP webshell generation deployed by INJ3CTOR3 with self-healing persistence channels and a built-in toll-fraud dialer. Back then, the fraud ran through the victim's own PBX, so removing the implant would have stopped it. Artifacts we collected from the operator's C2 staging servers during mid-September 2026 show that this is no longer true: the installer now sends credentials off…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →19 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1 | Medium | Score 53/100 | First seen |
| SHA256 | adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c | Medium | Score 53/100 | First seen |
| MD5 | 8b3a1d970fda0c17a0b785a990fb7b6a | Medium | Score 53/100 | First seen |
| SHA256 | c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d | High | Score 85/100 | First seen |
| MD5 | e1ebf9066a951be519a24140711839ea | Medium | Score 54/100 | First seen |
| SHA256 | b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b | Medium | Score 53/100 | First seen |
| URL | http://160.119.69.4/hima_data/index.php | High | Score 86/100 | First seen |
| SHA256 | 1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9 | Medium | Score 53/100 | First seen |
| MD5 | a2f6863413c4192a4abfa360577b9961 | Medium | Score 53/100 | First seen |
| MD5 | 7544725ebaaadac217dfaa7ca8e8fe7e | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-57819 | Medium | Score 53/100 | First seen |
| MD5 | bd42a8a0d23ae16c85dede7d2abaec05 | Medium | Score 53/100 | First seen |
| SHA256 | 38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838 | Medium | Score 53/100 | First seen |
| SHA256 | d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672 | Medium | Score 53/100 | First seen |
| URL | http://45.95.147.178/hima_data/index.php | High | Score 86/100 | First seen |
| CVE | CVE-2019-19006 | Medium | Score 53/100 | First seen |
| CVE | CVE-2021-45461 | Medium | Score 53/100 | First seen |
| IP | 160.119.76.250 | High | Score 61/100 | First seen |
| CVE | CVE-2025-64328 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…