CSIS entry 233 · April 2023
Researchers at Mandiant attributed a software supply chain attack on 3CX Desktop App software to North Korea-linked hackers. During its investigation, Mandiant found that this attack used a vulnerability previously injected into 3CX software. This is Mandiant’s first discovery of a software supply chain attack leveraging vulnerabilities from a previous software supply chain attack.
3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible · 2022 Late
3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible
https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain
Targeting of 3CXDesktopApp customers and crypto firms · Mar 2023
Suspected members of the North Korean Lazarus Group targeted customers of the voice and video conferencing software 3CXDesktopApp in a financially motivated supply-chain attack during March 2023. The infected infrastructure was spread primarily across European countries, with additional victims in South Africa, the United Kingdom, and North America. In addition to being targeted with an info-stealer, some victims—most of whom were cryptocurrency firms in Brazil, France, Germany, and Italy—were also infected with a second-stage payload.
Chained supply-chain attack on a VoIP communications software provider (3CX), several hundred thousand customers · (report 2023)
Die mehreren Hunderttausend Kunden im vorliegenden Fall zeigen eindrucksvoll das Potenzial eines solchen Angriffs. Möglich wären hier Ransomware-Angriffe oder Spionage bei den Kunden, wobei die tatsächliche Motiva - tion hinter dem beschriebenen Fall bisher unklar ist. Hervorzuheben ist die Verkettung verschiedener Supply- Chain-Angriffe wie in diesem Fall: Sie zeigt, dass Angreifer willens und in der Lage sind, Zugänge sehr detailliert zu analysieren, über einen längeren Zeitraum zu beobach- ten und abzuwägen, ob diese Zugänge systematisch und mit hohem Aufwand für Folgeangriffe genutzt werden können. Laut öffentlicher Berichterstattung wird der Angriff dem Subcluster „Labyrinth Chollima" zugeordnet, einem Teil der häufig als Lazarus bezeichneten APT-Gruppen.
3rd April – Threat Intelligence Report · 2023-04-03
Both Windows and macOS versions of 3CXDesktopApp, a VoIP application of 3CX Communications Company, were compromised and used to distribute Trojanized versions in a large-scale supply chain attack. In this widespread campaign, dubbed SmoothOperator, threat actors have misused 3CX’s application with a malicious file that is loaded using 3CXDesktopApp and beacons to the attacker’s infrastructure. More than 600,000 companies worldwide which use 3CX may be affected by this attack. The attack is linked to the North Korean Lazarus group, and is tracked as CVE-2023-29059.
3CX DesktopApp supply-chain attack timeline: Kaspersky and Mandiant link it to North Korea · 2023년 상반기
격리 조치를 시행함 (Sentinel One) 최초 GitHub에서 Base64 데이터가 추가된 ICO 파일을 가져오는 것이 공격 체인의 첫 단계이며, 이후 다단계로 이루어진 인포스틸러 DLL로 분석함 2023-03-30 (SentinelOne) MACOS 설치 프로그램의 감염 확인 2023-04-03 (Kaspersky) 단순 인포스틸러가 아니라 3CX 공급망 공격을 통해 배포된 백도어(Gopuram) 분석을 통해 북한 배후와 연관성 발표 2023-04-20 (Mandiant) 3CX의 내부 조사를 통해 TRADER_X를 통한 초기 침해와 두 개 공급망 공격의 연관성을 확인하였고, 2018년부터 이어온 CISA의 AppleJeus 분석과 연관하여 북한 배후 공격으로 지목함 표 3-1 3CX DesktopApp 공급망 공격의 주요 일지 X_TRADER의 악성 패키지는 코드 서명 인증서가 만료된 지난해 10월 이전에 3CX에 설치된 것으로 추정된다. [KISA report, page 47]
3CX / X_TRADER: UNC4736 linked to AppleJeus and Lazarus (Mandiant, CISA) · 2023년 상반기
Mandiant는 X_TRADER를 공격한 주체(UNC4736으로 명명)가 애플제우스(AppleJeus) 활동과 관련이 있다고 추정했으며, 미국 CISA는 애플제우스가 2018년부터 암호화폐 거래소 및 금융 서비스 회사를 노린 활동으로 북한 배후의 라자루스 그룹과 연관되었다고 평가했다. UNC4736 또는 라자루스는 금전 이익을 노리는 그룹으로 암호화폐 및 핀테크 서비스에 대한 공격에 중점을 두고 있다고 밝혔다. 또한 “SW 공급망이 연쇄적으로 공격 받았다는 것은 북한 해커의 역량이 지속해 증가하고 있다는 것을 의미한다. 북한 공격자들은 악성코드를 개발하고 유포하는 독창적인 방법(예: GitHub의 *.ico 파일에 C&C URL을 인코딩한 후 이를 다운로드하여 탐지를 피함, [그림 5] 참조)을 사용하고 있으며, 네트워크 간 이동을 통해 감염 범위를 확대하고 있다”고 했다. [KISA report, page 49]
CrowdStrike Prevents 3CXDesktopApp Intrusion Campaign · March
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 12 of 75, PDF p. 321). DPRK cyber actor: Lazarus Group; Report Name: CrowdStrike Prevents 3CXDesktopApp Intrusion Campaign; Case Summary: The Lazarus Group compromise d 3CX’s desktop applications for Windows and MacOS and bundled them with malware, which led customers of 3CX to inadvertently download malicious versions of the software and allowed the attackers to run arbitrary code on all machines where the software wasinstalled.; Publication Month: March
3CXDesktopApp supply chain intrusion campaign · March 29, 2023
On March 29, 2023, CrowdStrike observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp — a softphone application from 3CX. ... CrowdStrike Intelligence has assessed there is suspected nation-state involvement by the threat actor LABYRINTH CHOLLIMA. ... CSA-230387: LABYRINTH CHOLLIMA Uses TxRLoader and Vulnerable Drivers to Target Financial and Energy Sectors
Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack · 2023-04-03T12:10:52
A DLL named guard64.dll, which was loaded into the infected 3CXDesktopApp.exe process, was used in recent deployments of a backdoor that we dubbed “Gopuram” and had been tracking internally since 2020. | From article: During the investigation, we found that Gopuram coexisted on victim machines with AppleJeus , a backdoor attributed to the Korean-speaking threat actor Lazarus .
Elastic users protected from SUDDENICON’s supply chain attack · Fri, 05 May 2023 00:00:00 GMT
Elastic Security Labs is releasing a triage analysis to assist 3CX customers in the initial detection of SUDDENICON, a potential supply-chain compromise affecting 3CX VOIP softphone users. | From article: A shellcode stub prepended to the payload used to map it into memory shares similarities with APPLEJEUS loader stubs, which have been associated with DPRK .
3CX SmoothOperator | 3CXDesktopApp in Supply Chain Attack · 2023-03-29T23:06:53.000Z
Explore the intricacies of 3CX Smooth Operator. Learn about the multi-stage attack chain and infostealer malware delivery at scale. | From article: An update from Mandiant subsequently corrected this analysis and identified the backdoor as POOLRAT, a known Lazarus malware family.