Kaspersky Securelist
APT trends report Q2 2023 (DPRK-related paragraph 3) · 2023-07-27
On March 29, CrowdStrike issued an alert about a supply-chain attack affecting the popular 3CXDesktopApp VoIP software. In their report, they tentatively attributed the ongoing attack to Lazarus. While investigating campaigns related to the 3CX attack, we uncovered evidence of another supply-chain attack targeting the X_TRADING software developed by Trading Technologies. This attack has been ongoing since late 2021 and shares similarities with the 3CX campaign. We notified Trading Technologies of the compromise of its web service assets on March 31 this year, and included guidance on how to handle the situation. Furthermore, we discovered that the actor behind the 3CX attack, which we also believe to be Lazarus with medium-high confidence, is using a backdoor that we have named Gopuram ‘ to target selected victims of the 3CX intrusion. Our analysis of Gopuram dates back to 2020 when we first encountered it on compromised systems alongside the AppleJeus malware known to be associated with Lazarus.