Thanks for the alert! We still had an old, inherited, Fusion box (don't laugh, FS 1.6 still) running that was more or less forgotten about with a handful of customer. Have just hammered it shut and will move the few customers over asap. I think I got there in time.
I do not think that simply disabling chat and enabling authorization is the solution. Also, if your service requires SIP SIMPLE for chat, you will kill the service altogether, including on a fresh installation.
The malware is still there. They are simply running it through the API.
The malware needs to be cleaned up first, and a custom guard should be implemented for the API instead of disabling it. Upgrading does not clean the server, nor does disabling the API remove the malware.
But even then, the question remains: how did they install the malware in the first place?
If anyone has complete server logs covering the period from August 2026 to the present and would be willing to share them for security analysis, please let me know.
Finding the source of the malware files is more important. The API is simply being used to run them. I do not think the API is the source of the initial installation.
Of course do not share it publicly. If you can anonymize them would be wonderful. I cannot accept, and you should not give server credentials and customer data publicly.
The malware is still there. They are simply running it through the API.
The malware needs to be cleaned up first, and a custom guard should be implemented for the API instead of disabling it. Upgrading does not clean the server, nor does disabling the API remove the malware.
But even then, the question remains: how did they install the malware in the first place?
If anyone has complete server logs covering the period from August 2026 to the present and would be willing to share them for security analysis, please let me know.
Finding the source of the malware files is more important. The API is simply being used to run them. I do not think the API is the source of the initial installation.
Of course do not share it publicly. If you can anonymize them would be wonderful. I cannot accept, and you should not give server credentials and customer data publicly.
Last edited:
The api IS being used to download the files, if I remember rightly it executes some sort of curl command that pulls down the files, this also changes from time to time in what it does, I'll see if I can find the logs.
What the script also does is sets up a cronjob under the user www-data so you need to get rid of that.
Check: crontab -u www-data -l
What the script also does is sets up a cronjob under the user www-data so you need to get rid of that.
Check: crontab -u www-data -l
Yes. Yesterday, I was helping a friend, and I found everything through the crontab. That led me to discover the malware installations, quarantine them, and implement an API guard in the chatplan so that it rejects API requests without requiring us to disable chat or enable authorization.
Everything looks clean now, but the problem is that I still don't know how they got in because the logs were deleted by their own scheduled tasks. If you think they got in through the API, that is actually good news, since that route is now blocked.
Another question is: if they could install whatever they wanted, how come they didn't do the things I don't want to name here? Instead, they just tried to use the server for mining, which would only earn them a few cents a day on a CPU.
And I would like to clarify this once again. What FreeSWITCH has done, in my opinion, is irresponsible. All they have done is change a setting. This is not version-related. Any server with unauthenticated SIP SIMPLE enabled is vulnerable.
They should have provided a patch that disables API execution through SIP SIMPLE, limits its capabilities, or adds IP-based authentication for incoming requests. There are too many ways this could have been handled properly. A new version simply means that the setting is disabled by default.
And thank you again for always being there for us. I cannot tell you how much I appreciate your efforts over all these years. I look forward to seeing the logs, as I am both very curious and upset about this. I don't take security lightly, especially in telecommunications.
Also, may I ask you to change the title of this conversation by adding keywords such as “crash,” “high CPU,” and similar terms, so that more people can find it?
I found this convetsation only after I had already discovered the malware, identified the crypto mining, and been asked for help. Someone who is simply puzzled by what is happening is unlikely to find this conversation.
I believe this is a public safety matter, so making the discussion easier to discover could help others recognize the issue much sooner.
Everything looks clean now, but the problem is that I still don't know how they got in because the logs were deleted by their own scheduled tasks. If you think they got in through the API, that is actually good news, since that route is now blocked.
Another question is: if they could install whatever they wanted, how come they didn't do the things I don't want to name here? Instead, they just tried to use the server for mining, which would only earn them a few cents a day on a CPU.
And I would like to clarify this once again. What FreeSWITCH has done, in my opinion, is irresponsible. All they have done is change a setting. This is not version-related. Any server with unauthenticated SIP SIMPLE enabled is vulnerable.
They should have provided a patch that disables API execution through SIP SIMPLE, limits its capabilities, or adds IP-based authentication for incoming requests. There are too many ways this could have been handled properly. A new version simply means that the setting is disabled by default.
And thank you again for always being there for us. I cannot tell you how much I appreciate your efforts over all these years. I look forward to seeing the logs, as I am both very curious and upset about this. I don't take security lightly, especially in telecommunications.
Also, may I ask you to change the title of this conversation by adding keywords such as “crash,” “high CPU,” and similar terms, so that more people can find it?
I found this convetsation only after I had already discovered the malware, identified the crypto mining, and been asked for help. Someone who is simply puzzled by what is happening is unlikely to find this conversation.
I believe this is a public safety matter, so making the discussion easier to discover could help others recognize the issue much sooner.
Last edited: