3CX app updates delivered multi-stage malware

The 3CX incident is the cleanest modern example of one supply-chain attack becoming another. Mandiant found that the first known intrusion path into 3CX came from a trojanized X_TRADER installer downloaded from Trading Technologies' legitimate website. That earlier compromise installed VEILEDSIGNAL, giving the attacker a foothold that eventually reached 3CX's build environment.

Once inside 3CX, the actor compromised both Windows and macOS build systems. The Windows side used TAXHAUL and COLDCAT in the build environment, while the macOS build server carried POOLRAT. Signed 3CX Desktop App installers then became the distribution channel, carrying malicious code through normal vendor downloads and updates.

The shipped Desktop App malware ran SUDDENICON, which pulled command-and-control data from encrypted icon files hosted on GitHub. The decrypted infrastructure was then used to retrieve ICONICSTEALER, a dataminer focused on browser and application configuration data. Mandiant tied the activity to UNC4736, assessed as a suspected North Korean cluster with overlap to financially motivated AppleJeus activity.

The early response added another lesson. The Register reported that SentinelOne saw suspicious activity on March 22, 2023, but 3CX treated the alert as a likely false positive after VirusTotal checks came back clean. CrowdStrike reporting on March 29 forced the issue into the open, and 3CX told customers to move to the PWA while the desktop app was investigated.

Motive

Espionage

Attribution

State

Cause

Build System Compromise

Transitive

Yes

Actor

UNC4736

Actor Country

North Korea

User Impact

600000

• Locationmirror: malware-research.org/3cx-supply-chain-attack-iocs-indicators-of-compromise
• Locationmirror: crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers
• Locationmirror: github.com/sophoslabs/IoCs/blob/master/3CX-IoCs.csv
• Locationmirror: virustotal.com/gui/file/53a44c2396d15c3a03723fa5e5db54cafd527b9eceb8f99aeffcf6f8c609e5f4
• Locationmirror: securelist.com/the-3cx-incident-what-we-know/109371
• Locationmirror: cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise

• 3CX Software Supply Chain Compromisemandiant.com
• 3CX Supply Chain Compromise Leads to ICONIC Incidentvolexity.com
• CISA Alert AA23-090A - Supply Chain Compromise of 3CX Desktop Appcisa.gov
• 3CX thought supply chain attack was a false positivetheregister.com