FreePBX was hacked and Thankuohoh macro applied to extensions_custom.conf

FreePBX was hacked and Thankuohoh macro applied to extensions_custom.conf. A malicious configs.php file was found in /var/www/html. Error_log attached shows pastebin upload of configs.php to the aforementioned location. Could not find anything obvious in access_log.

Pastebin upload occurred on January 27, 2022 and international toll fraud calls started the next day, a Friday night, and went until early Monday morning.

The system is fully up to date, including all modules. Port 8080 was used for http access to GUI and was forwarded to server from router (i.e. exposed to the internet) and port 443 was used for https and also exposed.

Notes, error log, and access log are attached.