Full Report
In this blog, we contextualize the events and talk about enabling defense from the 3CX compromise.
Analysis Summary
# Incident Report: 3CXDesktopApp Supply Chain Compromise
## Executive Summary
A sophisticated supply chain attack targeted the 3CXDesktopApp, a popular VOIP softphone application, resulting in the distribution of malware-laden installers to customers. The campaign, attributed to North Korean state-sponsored actors, utilized a multi-stage infection chain to gain initial access and establish persistence on victim networks. The compromise underscores the significant risks inherent in trusted software ecosystems and the difficulty of detecting threats embedded in signed binaries.
## Incident Details
- **Discovery Date:** March 29, 2023
- **Incident Date:** Campaign activity identified as early as early 2022; significant infrastructure staging in December 2022.
- **Affected Organization:** 3CX and its global customer base (600,000+ companies).
- **Sector:** Technology / Communications / Software Development.
- **Geography:** Global.
## Timeline of Events
### Initial Access
- **Date/Time:** Early 2022 (initial infrastructure); December 2022 (intensified staging).
- **Vector:** Supply Chain Compromise.
- **Details:** Attackers compromised the 3CX build environment to inject malicious code into the Windows and macOS versions of the desktop application.
### Lateral Movement
- **Details:** Upon execution of the signed, malicious installer, the malware moved from the initial application process to pull down secondary payloads (typically encrypted .ico files from GitHub) to execute further shellcode and potentially pivot within the local network.
### Data Exfiltration/Impact
- **Details:** The primary impact was the compromise of system integrity for thousands of 3CX customers. The malware was designed to collect system information and potentially steal browser credentials and history.
### Detection & Response
- **Discovery:** Publicly disclosed by CrowdStrike and SentinelOne on March 29, 2023, following reports of antivirus alerts from customers.
- **Response Actions:** 3CX issued a notification to users to uninstall the desktop app and use the PWA (Web) version instead. Security vendors released YARA rules and signatures to identify the specific malicious DLLs.
## Attack Methodology
- **Initial Access:** Supply chain injection (tampering with legitimate software updates).
- **Persistence:** Implementation of a multi-stage loader; the malicious code resided within `ffmpeg.dll`, which was loaded by the legitimate `3CXDesktopApp.exe`.
- **Privilege Escalation:** Not explicitly detailed in initial reports, but typically involves standard post-exploitation techniques once the payload is active.
- **Defense Evasion:** Use of valid digital certificates (signed software) and steganography (hiding payloads in `.ico` files on GitHub).
- **Credential Access:** Targeting of browser data (Chrome, Edge, Brave, and Firefox) for stored credentials.
- **Discovery:** Collection of system metadata (OS version, hostname, account names).
- **Lateral Movement:** Execution of shellcode to facilitate further access within the environment.
- **Collection:** Gathering of browser profile information and environment details.
- **Exfiltration:** Communication with attacker-controlled domains and GitHub repositories to retrieve and execute third-party payloads.
- **Impact:** System compromise and potential loss of sensitive credentials.
## Impact Assessment
- **Financial:** Significant costs associated with incident response for 3CX and thousands of downstream customers.
- **Data Breach:** Compromise of system metadata and potentially sensitive credentials stored in web browsers.
- **Operational:** Widespread disruption as organizations were forced to disable the 3CX desktop client globally.
- **Reputational:** Massive trust deficit for 3CX as a software provider due to the nature of the supply chain compromise.
## Indicators of Compromise
- **Network Indicators:**
- hxxps[://]raw[.]githubusercontent[.]com/cool-tech-group/re-odana/main/ (Payload hosting)
- hxxps[://]d36wmt9iyv62nm[.]cloudfront[.]net/ (C2 infrastructure)
- hxxps[://]visualstudio-update[.]com/
- **File Indicators:**
- `3CXDesktopApp.exe` (Trojanized installer)
- `ffmpeg.dll` (Side-loaded malicious library)
- `d3dcompiler_47.dll` (Used in the infection chain)
- **Behavioral Indicators:**
- Unexpected outbound connections from `3CXDesktopApp.exe` to GitHub or unknown Cloudfront domains.
- `3CXDesktopApp.exe` spawning shells or unexpected subprocesses.
## Response Actions
- **Containment:** Organizations advised to immediately uninstall 3CX Windows/macOS desktop applications (v18.12.407 and v18.12.416).
- **Eradication:** Removal of malicious DLLs and cleanup of browser caches/stored credentials that may have been accessed.
- **Recovery:** Transitioning users to the 3CX Web Client (PWA) which was not affected by the specific binary compromise.
## Lessons Learned
- **Implicit Trust is a Risk:** Relying solely on the fact that a binary is "signed" by a known vendor is insufficient for modern security.
- **Vendor Transparency:** Rapid communication from the vendor is critical, though 3CX initially faced criticism for a perceived delay in confirming the compromise.
- **Supply Chain Fragility:** Single points of failure in the build pipeline can lead to catastrophic downstream effects.
## Recommendations
- **Binary Monitoring:** Implement EDR/XDR solutions that monitor the behavior of *all* signed binaries, not just unsigned ones.
- **Network Segmentation:** Limit the ability of desktop applications to reach out to unapproved external domains or GitHub repositories unless strictly necessary.
- **Software Inventory:** Maintain an accurate Bill of Materials (SBOM) and inventory to quickly identify affected assets during supply chain incidents.
- **Web-First Strategy:** Where possible, utilize PWA or browser-based versions of software to reduce the attack surface associated with installed local binaries.