24th April – Threat Intelligence Report · 2023-04-24
Researchers have discovered that last month’s 3CX Software supply chain attack was allegedly caused by an additional prior supply chain compromise. In that case, suspected North Korean attackers breached the site of stock trading automation company “Trading Technologies”, to push its trojanized software builds, and among other victims to infect 3CX.
Multiple organizations · 29/03/2023
A digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client compromised via exploitation of the CVE-2013-3900 vulnerability, is reportedly being used to target the company’s customers in an ongoing supply chain attack. [Date Occurred: -; Date Discovered: -]
Multiple organizations in the cryptocurrency sector · 03/04/2023
Researchers from Kaspersky reveal that some of the victims affected by the 3CX supply chain attack have also had their systems backdoored with Gopuram malware, with the threat actors specifically targeting cryptocurrency companies with this additional malicious payload. [Date Occurred: -; Date Discovered: 29/03/2023]
Trading Technologies · 20/04/2023
Researchers from Mandiant reveal that the 3CX supply chain attack was caused by another supply chain compromise where suspected North Korean attackers breached the site of stock trading automation company Trading Technologies to push trojanized software builds. [Date Occurred: -; Date Discovered: 29/03/2023]
Several critical infrastructure organizations in the United States and Europe · 21/04/2023
Researchers from Symantec/Broadcom reveal that the software supply chain attack that led to last month's 3CX breach has also impacted at least several critical infrastructure organizations in the United States and Europe. [Date Occurred: -; Date Discovered: -]
북 소행 ‘3CX’ 해킹, 다른 소프트웨어 감염서 시작 · 2023-04-21
attribution sentence(s): 앵커 : 북한 해킹 조직의 소행으로 알려진 지난달 기업용 음성 및 비디오 통화 프로그램 '3CX' 해킹 사건이, 이보다 | 미국의 사이버 보안 기업 ‘맨디언트’는 20일 보고서를 통해 소프트웨어 업체 ‘트레이딩 테크놀로지스’의 소프트웨어가 먼저 멀웨어(악성 소프트웨어)에 감염됐고, 이후 북한 해킹 조직이 이 감염 경로를 이용해 3CX를 해킹했다고 밝혔습니다. | 3CX의 설치 프로그램에 악성코드가 삽입돼 있다는 사실은 지난달 처음 알려졌는데, 여러 사이버 보안 업체들은 이 공격의 배후로 북한 해킹 조직을 지목했습니다.
3CX desktop application supply chain compromise (following Trading Technologies compromise) · March 2023
Para 113: “In March, hackers compromised 3CX’s desktop applications for Windows and macOS and bundled them with malware. As a result, customers of 3CX inadvertently downloaded malicious versions of the company’s voice- and video-calling software. ... This supply chain attack was the result of a previous supply chain attack on Trading Technologies, a financial software firm – a rare example of how a single perpetrator used one software supply chain attack to carry out another downstream. Targets included critical infrastructure in the energy sector. Cybersecurity companies have attributed this attack to the Lazarus Group.”
3CX supply chain compromise (via X_TRADER) · 2023
(MSMT/2025/2, report p. 30 (sidebar)) Sidebar “SUPPLYCHAIN ATTACKS”: “DPRK actors set the stage for supply chain-enabled cryptocurrency heists with the 2023 compromise of 3CX, a large telecommunications company that provides chat, video call, and voice call services. The DPRK actors leveraged a third-party app, X_TRADER, to develop backdoor access to 3CX ... As a result, DPRK actors trojanized legitimate 3CX software, configuring it to deliver multiple payloads that collected users’ browser information and implanted a malicious backdoor on user devices.”
Citrine Sleet 3CX supply chain attack (March 2023), leveraging prior compromise of a US-based financial technology company · Microsoft Digital Defense Report 2023
Microsoft attributed the March 2023 3CX supply chain attack—which leveraged a prior supply chain compromise of a US-based financial technology company in 2022—to Citrine Sleet.
3CX DesktopApp supply chain compromise initiated by the X_TRADER (Trading Technologies) supply chain compromise · 2023-04-20 (datePublished)
In March 2023, Mandiant Consulting responded to a supply chain compromise that affected 3CX Desktop App software. During this response, Mandiant identified that the initial compromise vector of 3CX’s network was via malicious software downloaded from Trading Technologies website. This is the first time Mandiant has seen a software supply chain attack lead to another software supply chain attack. ... UNC4736 demonstrates varying degrees of overlap with multiple North Korean operators tracked by Mandiant Intelligence, especially with those involved in financially-motivated cybercrime operations.
3CX Desktop App supply chain compromise (ICONIC) · 2023-03-30T11:37:54+00:00 (published_time)
Volexity now attributes the activity described in this post to the Lazarus threat actor. ... On Wednesday, March 29, 2023, Volexity became aware of a supply chain compromise by a suspected North Korean threat actor, which Volexity tracks as UTA0040*.
3CXDesktopApp Exposes Supply Chain Attack Risk · 2023-04-19T12:12:17.000Z
Learn about the recent 3CX supplychain attack and its impact. This blog covers the attack's vulnerability details, detection, and mitigation. | From article: Unfortunately, a group of hackers named Lazarus Group carried out the attack and were able to insert harmful code into the official software build.
3CX: Supply Chain Attack Affects Thousands of Users Worldwide · 30 Mar 2023
North Korean-sponsored actors believed to be linked to attack that Trojanized several versions of 3CX DesktopApp
X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in U.S. and Europe · 21 Apr 2023
North Korean-linked operation affected more organizations beyond 3CX, including two critical infrastructure organizations in the energy sector.
Red flags flew over software supply chain-compromised 3CX update | RL Blog · 2023-03-30T05:00:00.000Z
The VOIP software vendor missed signs that its client software had been tampered with before it pushed the update to customers. | From article: CrowdStrike and others have attributed the incident to a threat actor dubbed “LABYRINTH CHOLLIMA,” believed to be associated with the government of North Korea and known for targeting military and political entities.
The 3CX breach was targeted — but the plan was broader | RL Blog · 2023-04-04T05:00:00.000Z
The compromise was limited to their app. But there's a bigger lesson: Supply chain security complacency comes with a cost. | From article: Malware links 3CX to Lazarus Group crypto campaign While 3CX appears to be the only application targeted in this compromise, there is evidence that the attack was months in the making, and that the malicious actors behind the compromise had their eyes on a broader set of targets.
The 3CX attack gets wilder, marks first 'cascading supply chain compromise' | RL Blog · 2023-04-21T05:00:00.000Z
The surprising story of the supply chain hack of VoIP provider 3CX got even crazier this week. Here's what your application security need to know. | From article: Researchers identified the backdoor as an application named “VEILEDSIGNAL.” That backdoor gave the attackers, North Korean advanced persistent threat (APT) group UNC4736, access to the employee’s 3CX administrator credentials, which they then used to access the company’s network environment via a virtual private network (VPN) connection and move laterally within the company’s environment.
The Week in Security: 3CX attack caused by earlier supply chain hack, malware in Google Play | RL Blog · 2023-04-20T05:00:00.000Z
This week: One software supply chain attack caused another, making it a first for the industry. Also: Malware spreads via apps in the Google Play Store. | From article: Last week, we reported on the company’s confirmation that the actors behind this targeted attack are North Korean .
36gate: supply chain attack · 2023-03-31T10:59:09+00:00
What is known about the 3CX desktop app compromise in a supply chain attack attempt and how to defend against it? | From article: Attribution HTTPS beacon structure and encryption key match those observed by CrowdStrike in a March 7, 2023 campaign attributed with high confidence to DPRK-nexus threat actor LABYRINTH CHOLLIMA (aka Lazarus) — CrowdStrike reports.
3CX VoIP Software Compromise & Supply Chain Threats · 2023-03-30T00:00:00.000Z
While definitive attribution is not yet clear, the current consensus across the security community is that this attack was performed by a DPRK nation-state threat actor.
Contextualizing Events & Enabling Defense: What 3CX Means · 2023-03-31T00:00:00.000Z
The entity identified by CrowdStrike as responsible, Labyrinth Chollima (also referred to more generally, broadly, and potentially problematically as “ Lazarus Group ”), is linked to cyber operations ranging from traditional espionage to cryptocurrency theft to destructive attacks .
3CX desktop app used in a supply chain attack · 2023-03-30T23:12:00+00:00
While attribution in these cases is always difficult, some fingers are pointing to North Korea.