Scans for EncystPHP Webshell, (Mon, Apr 13th)
2026-04-13T13:23:51Z•8174ce880f2a48f73d113948ac9d927f1fd5d1b98ca03fad43d5b1d15b223b8e
encystphpfreepbxmalware-sampleobfuscated-javascriptphishingrarscanningsha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bwebshell
What happened
SANS ISC diary entries (Apr 7–13, 2026) report widespread scanning and attacker activity: scanners probing for the EncystPHP web shell (noted as popular against vulnerable FreePBX installs) and other webshells, including authors using harder-to-guess credentials. A phishing-delivered obfuscated JavaScript sample (cbmjlzan.JS, SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) was observed in a RAR archive and detected by few AVs. Additional diary items cover honeypot fingerprinting scans, analysis of number/year usage in passwords, and a TeamPCP supply-chain campaign 업데이트
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 8174ce880f2a48f73d113948ac9d927f1fd5d1b98ca03fad43d5b1d15b223b8e
- Enrichment time
- 2026-04-13T13:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.