# 3CX DesktopApp supply-chain attack (trojanized signed builds) · pwn.watch

> Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.

Page: https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: 3CX DesktopApp (Electron)
- Started: 2023-03-29 · closed: 2023-04-20
- CVEs: CVE-2023-29059
- Affected: Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD); macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)
- Fixed in: See vendor advisory

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023/feed.xml
- JSON Feed: https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json
- This file: https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023/llms.txt

## Updates (newest first)
- 2023-04-20: Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another (https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise)
- 2023-03-30: 3CX confirms the compromise and tells customers to uninstall the Electron desktop app (https://www.3cx.com/blog/news/desktopapp-security-alert/)
- 2023-03-29: CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines (https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/)

## Fix brief
# Security brief: 3CX DesktopApp supply-chain attack (trojanized signed builds)

Source: https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023 · status: closed (closed Apr 20, 2023) · severity: critical · updated Apr 20, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.

Severity detail: Software supply-chain compromise of a signed desktop app; CVSS 7.8 (NVD)

- Product: 3CX DesktopApp (Electron)
- CVE / advisory ids: CVE-2023-29059

## Affected versions
- Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD)
- macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)

## Check whether you're affected
Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:

```sh
npm ls electron
grep -n '"electron"' package.json
```

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- See vendor advisory

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Apr 20, 2023: Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another
- Mar 30, 2023: 3CX confirms the compromise and tells customers to uninstall the Electron desktop app
- Mar 29, 2023: CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines

## Advisories
- [3CX DesktopApp Security Alert](https://www.3cx.com/blog/news/desktopapp-security-alert/) (3CX)
- [Mandiant Security Update: Initial Intrusion Vector](https://www.3cx.com/blog/news/mandiant-security-update2/) (3CX)
- [NVD: CVE-2023-29059](https://nvd.nist.gov/vuln/detail/CVE-2023-29059) (NVD)

## Write-ups & news
- [CrowdStrike Detects and Prevents Active Intrusion Campaign Targeting 3CXDesktopApp Customers](https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/)
- [3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise](https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise)

## Caveats
Not in CISA KEV. Clean build numbers are listed in 3CX's own update posts; not repeated here.

---
Machine-readable: https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.