Our pbx was attacked this weekend

[mike9055]

This weekend attackers gained access to our pbx using stolen credentials of a user with management console privileges:

- they enabled every kind of international calls
- they disabled all notifications
- they made a lot of calls to "international networks" prefix +882 and several others
- made a bunch of outbound rules
- custom modified an extension
- maybe the downloaded backups (why doesn't the audit show if someone downloads a backup?? tried myself, doesn't show)

Ip address are form Ukraine, France and UK go ahead aand add them to you blacklist



I say: get ready for the Easter surprise