3CX customers targeted via trojanized desktop app
Suspected state-sponsored threat actors have trojanized the official Windows desktop app of the widely used 3CX softphone solution, a number of cybersecurity companies began warning on Wednesday.
What is 3CX?
3CX is Voice over Internet Protocol (VoIP) private automatic branch exchange (PABX) software that provides video conferencing and live chat capabilities.
3CX offers a Windows, macOS, Linux, Android and iOS version of the app, a Chrome extension, and the PWA (progressive web app) version so the software can be also used via any browser.
The company lists many high-profile companies and organizations among its 600,000+ enterprise customers.
What happened?
3CX CISO Pierre Jourdan says that the Windows version of the 3CX client app (based on the Electron framework) has been injected with malware, advised users to uninstall the app for the time being and use the PWA version until they are able to push out a clean version.
But Trend Micro and Crowdstrike researchers say that macOS versions of the 3CX desktop app have been trojanized, as well. More specifically, these files:
- 3cxdesktopapp-18.12.407.msi (Windows)
- 3cxdesktopapp-18.12.416.msi (Windows)
- 3CXDesktopApp-18.11.1213.dmg (macOS)
- 3cxdesktopapp-latest.dmg (macOS)
So, until 3CX finish their investigation and we know more, customers would do well to find and uninstall them. Both companies (and Sophos, and SentinelOne) have provided indicators or compromise 3CX customers can use to find evidence of compromise on their systems.
It’s still unclear how far back the trojanized versions began to get served to customers but, as Satnam Narang, staff research engineer at Tenable, pointed out, “3CX customers reported receiving threat alerts from SentinelOne as early as March 22.”
Who’s behind it?
3CX’s investigation will hopefully soon reveal the exact moment their legitimate apps have been switched with trojanized ones, and will be able to share how their delivery infrastructure has been compromised.
In the meantime, potentially affected customers should know that the malicious apps:
- Contacted various C2 servers
- Retrieved a second-stage payload hosted on a public GitHub repository, which then
- Downloaded info-stealing malware capable of grabbing system information, and data and stored login credentials from user profiles on Chrome, Edge, Brave, and Firefox browsers.
In a small number of cases, Crowdstrike researchers noted, hands-on-keyboard activity followed.
“The HTTPS beacon structure and encryption key [in this supply chain attack campaign] match those observed by CrowdStrike in a March 7, 2023 campaign attributed with high confidence to DPRK-nexus threat actor Labyrinth Chollima,” they added, so they believe North Korean state-sponsored hackers might be behind it. The other cybersecurity companies did not offer insight on who the attackers might be.
UPDATE (March 30, 2023, 08:10 a.m. ET):
Researcher Patrick Wardle has confirmed that the 3CX app for macOS has also been trojanized by the attackers.
At the same time, it seems like 3CX has been trying to downplay the intrusion for over a week:
Prior to @CrowdStrike's report – customers went to the 3CX forums expressing concerns that EDRs were reporting suspicious activity. EDRs from @CrowdStrike, @ESET, @PaloAltoNtwks, and @SentinelOne flagged the binary. 3CX said they were wrong.
Images via @malwrhunterteam pic.twitter.com/ysSk8gmcwn
— vx-underground (@vxunderground) March 30, 2023
UPDATE (April 2, 2023, 09:50 a.m. ET)::
You can read our most recent update on the situation.