Mass malware infection detected on Digium phones

More than half a million instances of malware have been observed on software used by the popular landline brand Digium in the first three months of the year.

Unit 42, the cyber-detective wing of infosecurity firm Palo Alto, said it had “witnessed more than 500,000 unique malware samples” over a three-month period to the end of March targeting the Elastix and Asterisk operating systems that Digium phones depend upon.

Though ostensibly conventional wired handsets, the phones benefit from special features including voicemail, call logging and queuing, and phone status display, which require them to be connected to the internet of things.

Unfortunately for businesses like call centers that rely on such features, they appear to have put the phones on the radar of cybercriminals.

“The attacker implants a web shell to exfiltrate data by downloading and executing additional payloads inside the target's Digium phone software,” said Unit 42. “The malware installs obfuscated back doors to the web server's file system, downloads new payloads for execution, and schedules recurring tasks to reinfect the host system.”

It did not specifically attribute the illicit campaign to any known threat group, but likened it to another by INJ3CTOR3 identified in 2020 that targeted voice-over-internet protocol (VoIP) system Sangoma.

Asterisk software is used to facilitate VoIP technology, which in turn enables the delivery of voice and multimedia communication via the internet. In this case it is also an integral component of Digium telephony, which also employs Elastix to facilitate features such as predictive dialing.

Unit 42 did not specify how many businesses or individuals have been adversely affected by the malware instances.