Full Report
What is known about the 3CX supply chain incident and how to defend against it?
Analysis Summary
# Incident Report: 3CX Supply Chain Compromise (SmoothOperator)
## Executive Summary
In March 2023, a sophisticated supply chain attack was identified targeting the 3CX DesktopApp, a popular VoIP communication platform. Attackers compromised the 3CX build environment to distribute trojanized versions of the software (Electron-based desktop clients) to thousands of customers globally. The incident, attributed to the North Korean threat actor group Lazarus (specifically the subgroup tracked as UNC4736 or SmoothOperator), utilized a multi-stage malware delivery system to facilitate data exfiltration and further environment compromise.
## Incident Details
- **Discovery Date:** Late March 2023
- **Incident Date:** Trojanized builds were signed as early as March 3, 2023; identified activity dates back to February 2023.
- **Affected Organization:** 3CX
- **Sector:** Telecommunications / Software Development
- **Geography:** Global (600,000+ customers, including major corporations and government entities)
## Timeline of Events
### Initial Access
- **Date/Time:** Circa early March 2023 (Distribution of trojanized updates)
- **Vector:** Supply Chain Compromise (Software Update Mechanism)
- **Details:** Attackers gained access to the 3CX build environment and injected malicious code into two DLLs (`ffmpeg.dll` and `d3dcompiler_47.dll`) which were then bundled into the official 3CX DesktopApp installer.
### Lateral Movement
- **Details:** Upon execution of the trojanized desktop app, the malware utilized side-loading techniques to run shellcode. This shellcode communicated with Command & Control (C2) servers to download additional payloads, enabling lateral movement within victim networks.
### Data Exfiltration/Impact
- **Details:** The primary goal included the theft of system information and browser credentials. The malware targeted sensitive data stored in Chrome, Edge, Brave, and Firefox browsers.
### Detection & Response
- **Discovery:** Multiple security vendors (CrowdStrike, SentinelOne, Volexity) and 3CX users reported suspicious behavior and beaconing to known malicious domains.
- **Response Actions:** 3CX issued notifications to customers, revoked compromised certificates, and released clean versions of the desktop application.
## Attack Methodology
- **Initial Access:** Validly signed software updates (Trojanized MSI installers).
- **Persistence:** The malware persisted as part of the 3CX DesktopApp installation, launching every time the application was started.
- **Defense Evasion:** Use of DLL side-loading, encrypted payloads hidden in `.ico` files on GitHub, and code signing with a legitimate 3CX certificate to bypass security software.
- **Credential Access:** Extraction of stored credentials and history from popular web browsers.
- **Discovery:** System information gathering (OS version, hostname, account names).
- **Lateral Movement:** C2-driven delivery of second-stage implants for further network penetration.
- **Exfiltration:** HTTPS-based exfiltration of stolen browser data and system metadata.
## Impact Assessment
- **Data Breach:** High risk; theft of browser credentials can lead to account takeovers across multiple platforms.
- **Operational:** Thousands of organizations were forced to uninstall the 3CX client and perform compromise assessments.
- **Reputational:** Significant impact on 3CX's brand trust as a secure communications provider.
## Indicators of Compromise
### Network Indicators (Defanged)
- msstorageazure[.]com
- officestoragebox[.]com
- visualstudiofactory[.]com
- azuredeploystore[.]com
- msstorageboxes[.]com
- officeaddons[.]com
- sourceslabs[.]com
- zacharryblogs[.]com
- pbxcloudeservices[.]com
- akamaitechcloudservices[.]com
- azureonlinestorage[.]com
- msedgepackageinfo[.]com
- glcloudservice[.]com
- pbxsources[.]com
- sbmsa[.]wiki
- journalide[.]org
- dunamistrd[.]com
- azureonlinecloud[.]com
- akamaicontainer[.]com
### File Indicators (SHA-256)
- `253f3a53796f1b0fbe64f7b05ae1d66bc2b0773588d00c3d2bf08572a497fa59` (ffmpeg.dll)
- `82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807` (d3dcompiler_47.dll)
## Response Actions
- **Containment:** Blocked known malicious C2 domains at the firewall and DNS levels.
- **Eradication:** Uninstallation of affected 3CX DesktopApp versions (Windows versions 18.12.407/416 and macOS versions 18.11.1213/1214).
- **Recovery:** Transitioning users to the 3CX Web Client (PWA) while the desktop app was rebuilt.
## Lessons Learned
- **Build Integrity:** Automated integrity checks are required for all third-party libraries and internal build outputs.
- **Certificate Security:** The validity of a digital signature does not guarantee the safety of the software.
- **Supply Chain Fragility:** A single point of failure in a software vendor's build pipeline can compromise hundreds of thousands of downstream targets.
## Recommendations
- **Endpoint Protection:** Deploy EDR/XDR solutions to detect DLL side-loading and suspicious child processes.
- **Software Management:** Transition to web-based applications (PWAs) where possible to reduce the attack surface of local binaries.
- **Zero Trust:** Implement strict network egress filtering to prevent unauthorized communication with unknown or newly registered domains.