INJ3CTOR3

Reports per quarter

Techniques seen in the last two years

• T1003 1 report
• T1021.004 1 report
• T1036.005 1 report
• T1053.003 1 report
• T1059.004 1 report
• T1068 1 report
• T1070.004 1 report
• T1071.001 1 report
• T1105 1 report
• T1136.001 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2014-7235
• CVE-2019-19006 KEV
• CVE-2021-45461
• CVE-2025-64328 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 28 January 2026

   Unveiling the Weaponized Web Shell EncystPHP | FortiGuard Labs

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Unveiling the Weaponized Web Shell EncystPHP | FortiGuard Labs

2. 15 July 2022

   Digium Phones Under Attack: Insight Into the Web Shell Implant

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Digium Phones Under Attack: Insight Into the Web Shell Implant

3. 5 November 2020

   INJ3CTOR3 Operation – Leveraging Asterisk Servers for Monetization - Check Point Research

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor INJ3CTOR3 Operation – Leveraging Asterisk Servers for Monetization - Check Point Research

4. 5 November 2020

   INJ3CTOR3 Operation – Leveraging Asterisk Servers for Monetization

   date in the title fromORKL

   The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor INJ3CTOR3 Operation – Leveraging Asterisk Servers for Monetization

Newest first. Details opens the report in Explore.