Hacker setting call forwarding?

… and without your being more forthcoming with us and providing logs, it’s impossible for us to help you.

Sorry, not hiding anything, the logs are gone.If it happens again, which log should I keep?

It would be in the full log in /var/log/asterisk/full there will also be 4 weeks worth of rotated logs (or should be) if this is a Distro install. So if this happened recently, it should be in your logs.

grep InternationalDID /var/log/asterisk/full* <-- Run that replacing InternationalDID with the DID

4 days, not 4 weeks.