UPDATE: The adversary targeting 3CX in a supply-chain attack has employed a second stage backdoor by exploiting CVE-2013-3900, a ten (10) year-old Windows vulnerability. The threat actor has been observed delivering their full-fledged modular backdoor to only a few select companies. This versatile backdoor known as “Gopuram” was deployed on less than ten (10) devices, primarily belonging to cryptocurrency companies. It is still believed that the Lazarus group, a North Korean state-sponsored hacking group, was behind the initial 3CX attack. The precision of the attacks and their specific aim at cryptocurrency companies further ties the North Korean government-backed hackers to the crime, as the sanctions-hit government has a history of targeting cryptocurrencies and other illicit financial assets to help fund their cyber operations. This deployment of a second backdoor aimed specifically at crypto targets helps clarify the intent of the initial attackers and suggests that this was the final payload of the attack chain.