3CX

Security vendors detected malicious activity in 3CX's desktop app and discovered the software was compromised in a supply chain attack.

"This update is only to ensure that the trojan has been removed from the 3CX Server where Desktop Apps are stored and in case any users decide to deploy the app anyway." According to SentinelOne's report, the Trojanized 3CX desktop app is the first part of a multi-stage attack chain targeting both Windows and Mac users. But Galea noted that 3CX plans to update the servers overnight with a new version of the Electron app, which may cause brief disruptions in service. In a follow-up advisory on Thursday afternoon, Nick Galea, CEO, CTO and founder of 3CX, said the company hired Google subsidiary Mandiant to investigate the attacks. However, forum moderators appeared to dismiss the issue to an error on SentinelOne's part and advised customers to contact the endpoint security vendor to resolve the problem. SentinelOne's platform automatically detected and blocked the [Trojanized](https://www.techtarget.com/searchsecurity/definition/Trojan-horse) executable for about a week. "The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity," CrowdStrike wrote in a blog post. [security advisory](https://www.3cx.com/blog/news/desktopapp-security-alert/) Thursday morning from CISO Pierre Jourdan alerting customers that several versions of its Electron Windows app contained a "security issue." It added that the campaign was connected to North Korean state-sponsored hacking group Labyrinth Chollima, also known as [Lazarus Group](https://www.techtarget.com/searchsecurity/news/252448325/Lazarus-Group-hacker-charged-in-Wannacry-Sony-attacks) or APT 38. We're still researching the matter to be able to provide a more in-depth response later today," Jourdan said. "We recommend that you DO NOT install or deploy the Electron App," Galea wrote in the latest advisory. [published research](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/) on the supply chain attacks and revealed that it observed a spike in behavioral detections of the 3CXDesktopApp.exe starting on March 22.

Hackers working on behalf of the North Korean government have pulled off a massive supply chain attack on Windows and macOS users of 3CX, a widely used ...

The DLL file then used the list to download and run a final payload from one of the URLs. “After this step is finally accomplished, the final payload is downloaded from one of these URLs and executed.” [from Symantec](https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3cx-supply-chain-attack) indicates the compromised installers for Windows and Mac contain clean versions of the app with all of their normal functionality, preventing end users from suspecting anything is amiss. As is the case with 3CX, the SolarWinds hackers compromised the company's software build system and used it to distribute a backdoored update to [roughly 18,000 customers](https://arstechnica.com/information-technology/2020/12/18000-organizations-downloaded-backdoor-planted-by-cozy-bear-hackers/). The payload was encrypted and contained other defenses designed to prevent detection or analysis. That same day, 3CX users [started online threads](https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/) discussing what they believed were potential false-positive detections of 3CXDesktopApp by their endpoint security apps. Many of the attacker-controlled servers that infected machines reach out to have already been shut down, he added. [SolarWinds network management](https://arstechnica.com/information-technology/2020/12/russian-hackers-hit-us-government-using-widespread-supply-chain-attack/)software. Preparations for the sophisticated operation began no later than February 2022, when the threat actor registered a sprawling set of domains used to communicate with infected devices. “This includes partnerships with vendors or the use of a third-party software which most businesses are reliant on in some way. The attack came to light late on Wednesday, when products from various security companies began detecting malicious activity coming from legitimately signed binaries for 3CX desktop apps. [600,000+ customers](https://www.3cx.com/company/customers/),” including American Express, Mercedes-Benz, and Price Waterhouse Cooper.

3CX will be releasing an update for the DesktopApp in the next few hours; meanwhile, users are urged to use the PWA Client instead.

Researchers observed malicious activity originating from a trojanized version of the 3CX DesktopApp. Crowdstrike, on the other hand, claims that the MacOS version has also been infected. 3CX is working on a software update for its 3CX DesktopApp, after multiple security researchers alerted the company of an active supply chain attack in it. The company has over 600,000 customers and 12 million users in 190 countries. As an immediate response, the company advised users to uninstall and reinstall the app. [3CX](https://www.3cx.com/company/) is a Voice Over Internet Protocol (VoIP) IPBX software development company.

Suspected state-sponsored threat actors have trojanized the official Windows desktop app of the widely used 3CX softphone solution.

Both companies (and 3CX said they were wrong. The other cybersecurity companies did not offer insight on who the attackers might be. EDRs from [@CrowdStrike], [@ESET], [@PaloAltoNtwks], and [@SentinelOne]flagged the binary. - 3cxdesktopapp-latest.dmg (macOS) [confirmed](https://objective-see.org/blog/blog_0x73.html) that the 3CX app for macOS has also been trojanized by the attackers. - 3CXDesktopApp-18.11.1213.dmg (macOS) - 3cxdesktopapp-18.12.416.msi (Windows) - 3cxdesktopapp-18.12.407.msi (Windows) [Sophos](https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/), and [SentinelOne](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/)) have provided indicators or compromise 3CX customers can use to find evidence of compromise on their systems. [Trend Micro](https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html) and [Crowdstrike](https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/) researchers say that macOS versions of the 3CX desktop app have been trojanized, as well. [says](https://www.3cx.com/blog/news/desktopapp-security-alert/) that the Windows version of the 3CX client app (based on the Electron framework) has been injected with malware, advised users to uninstall the app for the time being and use the PWA version until they are able to push out a clean version.

Hackers behind an attack on 3CX and its customers may still have access to the 3CX software supply chain, a Huntress researcher says.

“Perhaps this may change the tradecraft we see in the coming days.” Major customers listed by 3CX include American Express, McDonald’s, Coca-Cola, NHS, Toyota, BMW and Honda. “This appears to have been a targeted attack from an advanced persistent threat, perhaps even state sponsored, that ran a complex supply chain attack” using the Windows version of the app, 3CX’s Jourdan “It is not yet clear whether or not adversaries still have access to the 3CX supply chain in order to poison future updates,” Hammond wrote. [wrote](https://www.crn.com/news/security/3cx-we-re-aware-of-complex-supply-chain-attack-) that the company is “working on a new Windows App that does not have the issue.” It’s possible the hackers behind a potentially far-reaching supply chain attack on 3CX and its customers may still be able to compromise additional updates by the vendor to the app, according to a security researcher from Huntress.

Researchers warn a state-linked actor has launched malicious activity against a voice application widely used by major corporate customers.

The observed behavior included beaconing to infrastructure controlled by a threat actor, the deployment of second stage payloads, and in a small number of cases hands-on-keyboard activity. Its customers include major firms like PepsiCo, the U.K.'s National Health Service, Best Western and Air France, according to the 3CX website. [began to see a spike in behavioral detections](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/) starting on March 22. Other researchers have not been able to confirm activity on macOS. [according to Huntress](https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats). North Korea-linked threat actors are suspected in the attack.

VoIP provider 3CX urges users to uninstall the desktop app, amid concerns that state-sponsored hackers may be behind the attack.

In the meantime, 3CX says users can use its [web-based app](https://www.3cx.com/user-manual/web-client/#h.85vdwzu7eh2a) as a substitute. [urging](https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/) users to uninstall the affected software, which includes versions 18.12.407 and 18.12.416 of the Windows app. It remains unclear how the hackers breached 3CX to hijack the desktop app. The company has also uncovered evidence the malicious activity is coming from the infamous North Korean state-sponsored group known as [Lazarus](/security/85665/us-charges-3-north-korean-hackers-for-trying-to-steal-13-billion), which the FBI tied to the 2014 Sony Pictures hack. “The vast majority of systems, although they had the files dormant, were in fact never infected,” it adds. [according](https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html) to security firm Trend Micro.

"It's not exactly our place to comment on it," 3CX rep says of malicious detection.

- From provider to provider - so at the end, you and the community would know if it is still save and sound? I think in this case at least, it makes more sense if the SentinelOne customers contact their security software provider and see why this happens. In a few cases, the attackers carried out “hands-on-keyboard activity” on infected machines, meaning the attackers manually ran commands on them. On Friday, a day later, and again on the following Monday and Tuesday, more users reported receiving the SentinelOne warning. Wouldn't it be nice if you from 3CX would contact SentinelOne and figure out if this is a false positive or not? Users soon decided the detection was a false positive triggered by a glitch in the SentinelOne product.