Full Report
The 3CX VoIP Desktop Application has been compromised to deliver malware via legitimate 3CX updates. Huntress has been investigating this incident and working to validate and assess the current supply chain threat to the security community.
Analysis Summary
# Incident Report: 3CX Desktop Application Supply Chain Compromise
## Executive Summary
The 3CX VoIP Desktop Application was compromised in a major supply chain attack where legitimate, digitally signed updates delivered malware to Windows and Mac users. The attack involved a multi-stage loader hidden within bundled DLLs to establish command-and-control (C2) communications. Millions of users are potentially affected, with over 242,000 publicly exposed management systems identified globally.
## Incident Details
- **Discovery Date:** March 29, 2023
- **Incident Date:** March 13, 2023 (Initial signing of malicious binaries)
- **Affected Organization:** 3CX and its global customer base
- **Sector:** Telecommunications / VoIP Software
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** March 13, 2023 (Approximate)
- **Vector:** Software Supply Chain Compromise
- **Details:** Attackers compromised the 3CX build environment or update infrastructure, allowing them to include malicious code in legitimate, signed versions of the 3CX DesktopApp.
### Lateral Movement
- **Details:** The initial stage involves a loader (**ffmpeg.dll**) that pulls encrypted payloads from **d3dcompiler_47.dll**. While specific lateral movement within end-user networks varies, the malware is designed to establish C2 for further instruction and potential expansion.
### Data Exfiltration/Impact
- **Details:** The malware targets system information and establishes communication with external C2 servers to potentially download further malicious stages or steal sensitive data from the host environment.
### Detection & Response
- **Detection:** March 29, 2023, at 11:40 AM EDT. Huntress received reports of EDR/AV alerts (specifically via CrowdStrike) regarding the 3CX binary.
- **Response:** Huntress identified 2,783 infected hosts within their partner base, issued incident reports, and released a PowerShell script to help organizations scan for malicious hashes and file versions.
## Attack Methodology
- **Initial Access:** Supply chain injection into legitimate software updates.
- **Persistence:** Installation of the 3CX DesktopApp as a persistent service/application on the host.
- **Defense Evasion:** Use of legitimate 3CX digital signatures to bypass security controls; DLL side-loading (using a backdoored `ffmpeg.dll` to load encrypted data from `d3dcompiler_47.dll`).
- **Discovery:** The malware performs reconnaissance on the host system.
- **Exfiltration:** C2 communication initiated to external domains.
- **Impact:** Potential for full system compromise and disruption of telecommunications.
## Impact Assessment
- **Financial:** Not yet disclosed, but significant remediation costs for 600,000+ customers.
- **Data Breach:** Sensitive host information and potential C2-directed theft.
- **Operational:** High; 3CX urged users to uninstall the app, potentially disrupting business communications.
- **Reputational:** High; 3CX faces scrutiny over the integrity of their build pipeline and delayed communication.
## Indicators of Compromise
- **File Indicators (Hashes):**
- `3CXDesktopApp.exe` (Signed March 13, 2023)
- `ffmpeg.dll` (Backdoored loader): `7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896`
- `d3dcompiler_47.dll` (Encrypted payload): `11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03`
- **Affected Versions:**
- Windows: 18.12.407, 18.12.416
- Mac: 18.11.1213, 18.12.402, 18.12.407, 18.12.416
## Response Actions
- **Containment:** Organizations are advised to uninstall the compromised desktop application immediately.
- **Eradication:** Use of PowerShell scripts (provided by Huntress) to identify and remove malicious files across environments.
- **Recovery:** Shift to the Web Client (PWA) as an alternative to the desktop application until a clean update is verified.
## Lessons Learned
- **Digital Signatures are not a Silver Bullet:** A "signed" binary from a trusted vendor does not guarantee safety.
- **Supply Chain Vulnerability:** Even small components (like FFmpeg DLLs) can be leveraged for sophisticated attacks.
- **Alert Fatigue:** Initial EDR alerts were met with confusion by some users who thought they were false positives due to the software's legitimacy.
## Recommendations
- **Zero Trust Principles:** Monitor the behavior of all signed applications, especially those with network capabilities.
- **Software Inventory:** Maintain a rigorous SBOM (Software Bill of Materials) and inventory to quickly identify affected assets during supply chain incidents.
- **Alternative Access:** Use browser-based Progressive Web Apps (PWA) where possible to minimize the attack surface of local binary installations.