Hi,
This sounds like a SIP attack on your phones, quite possibly a product called "SIPVicious" this can be used to make malicious calls, scan VoIP packets and devices on a network and even cracking SIP account passwords.
These normally get onto a network from software downloaded onto a PC on the network. To stop this you will need to investigate where the software is running, this can be done by taking a network traffic trace of packets being sent to the phone, some phones will be able to record traces directly on them, I know many Yealink models allow this. Although if your phones do not have this functionality then you might need to put some networking equipment between the phone and the rest of the network so that you can capture all of the traffic to the phone.
Once you have got a trace with some malicious packets then you can look at these and determine the source of the attack, once you have this information then depending on source of the packets you can take action, if this is a PC on your network then performing a scan with your anti-virus software will most likely remove the infection, and if the source of this is not on your network then you can block the malicious packets from your firewall.
I believe you do have a reseller who should be able to assist you in this.
I hope this helps, if you have any further queries let us know and we will do our best to help.
Kind Regards,
Jay