What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
May 31, 2023
CVE-2023-2868 – Barracuda Zero-Day Vulnerability
THE THREAT On May 23rd, the email security company Barracuda disclosed a new vulnerability impacting Barracuda Email Security Gateway (ESG) appliances. Exploitation of the vulnerability, by threat…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Mar 20, 2023
Exertis and eSentire Partner to Deliver 24/7 Multi-Signal MDR, Digital Forensics & IR Services and Exposure Management to Organisations Across the UK, Ireland, and Europe
Basingstoke, UK– 20 March, 2023. Leading technology distributor, Exertis, announced today that it has bolstered its cybersecurity services, adding eSentire, the Authority in Managed Detection and Response (MDR), to its Enterprise portfolio of offerings. eSentire’s award-winning, 24/7 multi-signal MDR, Digital Forensics & Incident Response (IR), and Exposure Management services will be available…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Security advisories — Mar 30, 2023

3CX Supply Chain Attack

2 minutes read
Speak With A Security Expert Now

THE THREAT

eSentire is aware of an ongoing supply chain attack impacting the voice and video conferencing application 3CXDesktopApp.

As of March 22nd, 2023, a digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client is being used in a supply chain attack to target 3CX customers. Attackers are targeting Windows and macOS users of the compromised 3CX softphone app.

The Electron Windows App version numbers 18.12.407 & 18.12.416, were compromised to include malicious content. Anti-Virus vendors have flagged the executable 3CXDesktopApp.exe and in some cases uninstalled it. Electron Mac App version numbers 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 are also affected.

Malicious versions of the application result in the deployment of information stealer malware. This activity has been tentatively attributed to the North Korean state-sponsored Advanced Persistent Threat (APT) group Labyrinth Chomila. Organizations employing the malicious software are strongly recommended to uninstall the desktop application until a verified secure update is released.

What we’re doing about it

What you should do about it

Additional information

The supply chain attack, dubbed 'SmoothOperator,' starts when the MSI installer is downloaded from 3CX's website or when an update is pushed to an already installed desktop application.

When the MSI or update is installed, it will extract a malicious ffmpeg.dll and the d3dcompiler_47.dll DLL files, which are used to perform the next attack stage. The malware can harvest system info and steal data and stored credentials from Chrome, Edge, Brave, and Firefox user profiles.

Multiple customers have reported that the VoIP client app was marked malicious by Windows Defender, SentinelOne, CrowdStrike, ESET, Palo Alto Networks, and SonicWall security software. SentinelOne detects "penetration framework or shellcode" while analyzing the 3CXDesktopApp.exe binary, ESET tags it as a "Win64/Agent.CFM" trojan, Sophos as "Troj/Loader-AF," and CrowdStrike's Falcon OverWatch managed threat hunting service warns users to investigate their systems for malicious activity "urgently."

At this time, it remains unclear how the 3CX build was initially compromised. The eSentire Threat Intelligence team continues to track this topic for additional details and detection opportunities.

Impacted Application Versions:

Domains contacted by the malicious application have been taken down. Publicly reported Indicators of Compromise (IoCs) are as follows:

Indicators of Compromise

akamaicontainer[.]com

URL

akamaitechcloudservices[.]com

URL

azuredeploystore[.]com

URL

azureonlinecloud[.]com

URL

azureonlinestorage[.]com

URL

dunamistrd[.]com

URL

glcloudservice[.]com

URL

journalide[.]org

URL

msedgepackageinfo[.]com

URL

msedgeupdate[.]net/Windows

URL

msstorageazure[.]com

URL

msstorageboxes[.]com

URL

officeaddons[.]com

URL

officestoragebox[.]com

URL

pbxcloudeservices[.]com

URL

pbxphonenetwork[.]com

URL

pbxsources[.]com

URL

qwepoi123098[.]com

URL

sbmsa[.]wiki

URL

sourceslabs[.]com

URL

visualstudiofactory[.]com

URL

zacharryblogs[.]com

URL

github[.]com/IconStorages/images

URL

cad1120d91b812acafef7175f949dd1b09c6c21a

SHA-1

bf939c9c261d27ee7bb92325cc588624fca75429

SHA-1

20d554a80d759c50d6537dd7097fed84dd258b3e

SHA-1

aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868

(3cxdesktopapp-18.12.407.msi)

SHA256

59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983

(3cxdesktopapp-18.12.416.msi)

SHA256

c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02

(ffmpeg.dll)

SHA256

7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896

(ffmpeg.dll)

SHA256

11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03

(d3dcompiler_47.dll)

SHA256

4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f

SHA256

[email protected][.]me

Email

[email protected][.]me

Email

References:

[1] https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
[2] https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/
[3] https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
[4] https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
[5] https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/SamScissors
[6] https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
[7] https://www.3cx.com/blog/news/desktopapp-security-alert/

View Most Recent Blogs