EncystPHP Telephony Resource Hijacking via Asterisk CLI

Ethan Andrews@eandrews

•updated Feb 27, 2026•3•0•30

Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.