Security News > 2022 > July > Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads.

"The malware installs multilayer obfuscated PHP backdoors to the web server's file system, downloads new payloads for execution, and schedules recurring tasks to re-infect the host system," Palo Alto Networks Unit 42 said in a Friday report.

The unusual activity is said to have commenced in mid-December 2021 and targets Asterisk, a widely used software implementation of a private branch exchange that runs on the open-source Elastix Unified Communications Server.

The attacks commence with retrieving an initial dropper shell script from a remote server, which, in turn, is orchestrated to install the PHP web shell in different locations in the file system as well as create two root user accounts to maintain remote access.

Besides taking measures to cover its tracks, the malware is also equipped to run arbitrary commands, ultimately allowing the hackers to take control of the system, steal information, while also maintaining a backdoor to the compromised hosts.

"The strategy of implanting web shells in vulnerable servers is not a new tactic for malicious actors," the researchers said, adding it's a "Common approach malware authors take to launch exploits or run commands remotely."

News URL

https://thehackernews.com/2022/07/hackers-targeting-voip-servers-by.html