3CX DesktopApp supply-chain attack (trojanized signed builds)
3CX DesktopApp (Electron)
Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.
Why this severity: Software supply-chain compromise of a signed desktop app; CVSS 7.8 (NVD)
- Started
- Mar 29, 2023
- Closed
- Apr 20, 2023
Affected
- Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD)
- macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)
Fixed in
- See vendor advisory
Updates by day3
▸Apr 20, 2023
Link #Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another
Source
▸Mar 30, 2023
Link #3CX confirms the compromise and tells customers to uninstall the Electron desktop app
Source
▸Mar 29, 2023
Link #CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines
Source
Advisories3
News & write-ups2
Notes & caveats
Not in CISA KEV. Clean build numbers are listed in 3CX's own update posts; not repeated here.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
