{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T01:56:39.502Z",
  "tag": {
    "id": "3cx",
    "label": "3CX",
    "isStack": false,
    "url": "https://pwn.watch/t/3cx",
    "feed": "https://pwn.watch/t/3cx/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "3cx-desktopapp-supply-chain-attack-2023",
      "title": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023",
      "json": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "3CX DesktopApp (Electron)",
      "tags": [
        "3cx",
        "supply-chain",
        "electron",
        "north-korea",
        "windows",
        "macos"
      ],
      "cveIds": [
        "CVE-2023-29059"
      ],
      "affectedVersions": [
        "Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD)",
        "macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)"
      ],
      "fixedVersions": [
        "See vendor advisory"
      ],
      "startedAt": "2023-03-29",
      "closedAt": "2023-04-20",
      "updatedAt": "2023-04-20",
      "summary": "Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-20",
      "title": "Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "3CX confirms the compromise and tells customers to uninstall the Electron desktop app",
      "body": null,
      "sourceUrl": "https://www.3cx.com/blog/news/desktopapp-security-alert/",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-29",
      "title": "CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines",
      "body": null,
      "sourceUrl": "https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    }
  ]
}