3CX Confirms Embedded Malware in Desktop Applications, Impacting Thousands of Companies

Posted byflash@ankura.com

3CX, an enterprise communications software solutions manufacturer, has confirmed that various versions of its desktop application for Windows and macOS are affected by an active supply-chain attack, potentially impacting thousands of companies. 3CX has a client base of approximately 600,000 companies and the impacted versions currently include 18.12.407 and 18.12.416 for Windows as well as 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 for macOS. Nick Galea, 3CX’s founder and chief executive, confirmed that the desktop application is embedded with malware and Pierre Jourdan, 3CX’s chief information security officer, detailed that the attack “appears to have been a targeted attack from an Advanced Persistent Threat, perhaps even state sponsored, that ran a complex supply chain attack and picked who would be downloading the next stages of their malware.” Various cybersecurity companies have published reports on the attack, and some researchers have noted code that “exactly matches” malware historically identified in attacks by the notorious North Korean threat actor Lazarus Group (while CrowdStrike specifically cites a sub-cluster known as Labyrinth Chollima). This situation has the potential for further damage, such as mass attacks, including widespread exfiltration of data. It should also be noted that any money generated from this ongoing supply-chain attack has the potential to be funding the North Korean government. 3CX users are urged to update their self-hosted and on-premises versions of the software to version 18.12.422 to mitigate the risk of exploitation. CTIX analysts will continue to monitor the repercussions of the 3CX compromise and report all updates as they become available. Additional technical information of this attack as well as indicators of compromise (IOCs) can be reviewed in the reports linked below.