{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "3CX DesktopApp supply-chain attack (trojanized signed builds) · updates",
  "home_page_url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023",
  "feed_url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023/feed.json",
  "description": "Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.",
  "language": "en",
  "_pwn": {
    "slug": "3cx-desktopapp-supply-chain-attack-2023",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023/feed.xml",
    "llms": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023/llms.txt",
    "json": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023#2023-04-20-ec259044",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023#2023-04-20-ec259044",
      "title": "3CX DesktopApp supply-chain attack (trojanized signed builds): Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another",
      "content_text": "3CX DesktopApp supply-chain attack (trojanized signed builds): Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another\n\nSource: https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise",
      "date_published": "2023-04-20T00:00:00.000Z",
      "external_url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023#2023-03-30-6f2f597b",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023#2023-03-30-6f2f597b",
      "title": "3CX DesktopApp supply-chain attack (trojanized signed builds): 3CX confirms the compromise and tells customers to uninstall the Electron desktop app",
      "content_text": "3CX DesktopApp supply-chain attack (trojanized signed builds): 3CX confirms the compromise and tells customers to uninstall the Electron desktop app\n\nSource: https://www.3cx.com/blog/news/desktopapp-security-alert/",
      "date_published": "2023-03-30T00:00:00.000Z",
      "external_url": "https://www.3cx.com/blog/news/desktopapp-security-alert/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023#2023-03-29-5bf37680",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023#2023-03-29-5bf37680",
      "title": "3CX DesktopApp supply-chain attack (trojanized signed builds): CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines",
      "content_text": "3CX DesktopApp supply-chain attack (trojanized signed builds): CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines\n\nSource: https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/",
      "date_published": "2023-03-29T00:00:00.000Z",
      "external_url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/",
      "tags": [
        "critical"
      ]
    }
  ]
}