--- title: "Technical Advisory: Software Supply Chain Attack Against 3CX Desktop App" description: On March 29, 2023, researchers documented a malicious campaign targeting 3CX Desktop App customers. 3CX Desktop App is a VoIP software application with 12M+ daily users. image: https://businessinsights.bitdefender.com/hubfs/3CX.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) ![3CX-1](https://businessinsights.bitdefender.com/hubfs/3CX-1.jpg) [#Threat Research](https://businessinsights.bitdefender.com/topic/threat-research) [#Cybersecurity Awareness](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) [##Featured](https://businessinsights.bitdefender.com/topic/featured) By [**Martin Zugec**](https://businessinsights.bitdefender.com/author/martin-zugec) / Mar 31, 2023 # Technical Advisory: Software Supply Chain Attack Against 3CX Desktop App Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app&utm_medium=social&utm_source=facebook) On March 29, 2023, security researchers [documented](https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/) a malicious campaign targeting 3CX Desktop App customers. 3CX Desktop App is a software application developed by [3CX](https://www.3cx.com/), a Voice over Internet Protocol (VoIP) solutions provider with 12M+ daily users. This application is available for Windows, macOS, Linux, and mobile.  **Update 7** of the 3CX Desktop App application for Windows and macOS was compromised by threat actors believed to be linked to North Korea. Trojanized versions of the 3CX Desktop App installers (`.msi` for Windows, `.dmg` for macOS) were published on the developer’s website. As of the writing of this article, the method by which this update was compromised remains unknown.  ## Description of vulnerability The installer for **Windows** would extract the legitimate `3CXDesktopApp.exe` (fully functional), but also the malicious libraries `ffmpeg.dll` and `d3dcompiler_47.dll`. When the application is executed, it uses a technique called DLL sideloading (read our [DLL sideloading explainer](https://www.bitdefender.com/blog/businessinsights/tech-explainer-what-is-dll-sideloading/)) to load the malicious `ffmpeg.dll` library in memory.  `ffmpeg.dll` library decrypts the payload from the `d3dcompiler_47.dll` library and executes it as a shellcode. Malware is suspended for 1-4 weeks as a detection evasion technique, after this period it will try to download a `.ico` file from the domain `githubusercontent[.]com` (no longer available) and extract from it an address of a command & control (C2) server. This domain hosted multiple icon files, each associated with a different C2 domain.  ![](https://businessinsights.bitdefender.com/hubfs/undefined-Mar-31-2023-05-17-14-9696-PM.png) The installer for **macOS** is a simplified version of the trojanized installer for Windows. The malicious library `libffmpeg.dylib` includes an embedded list of hardcoded C2 servers. This list is identical for both Windows and macOS versions.  Multiple Windows and macOS versions of the software were affected:  - Windows – versions 18.12.407, 18.12.416 - macOS – versions 18.11.1213, 18.12.402, 18.12.407, 18.12.416 ## Conclusion and recommendations Bitdefender continues monitoring the situation, but we haven’t detected any active exploitation attempts for our customers. Below are the detection names used in the [Bitdefender GravityZone](https://www.bitdefender.com/business/gravityzone-platform/) platform:  ### Windows - `Trojan.SupplyChainAgent.A ` - `Trojan.SupplyChainAgent.B ` - `Trojan.SupplyChainAgent.C ` ### macOS - `Trojan.MAC.SupplyChainAgent.1 ` - `Trojan.MAC.SupplyChainAgent.2` We also recommend 3CX customers stay up to date with the [latest advisory](https://www.3cx.com/blog/news/desktopapp-security-alert-updates/), as the situation is still developing. Conduct an extensive infrastructure and software application audit to identify all systems where compromised software was deployed. To locate the vulnerable versions of 3CX Desktop App software in your environment, you can use **Live Search** query feature of the GravityZone platform. With Live Search, you can retrieve information about events and system statistics directly from online endpoints using OSquery, an operating system instrumentation framework that uses the SQLite query language. This is currently available for customers that have enrolled in the Early Access program available in GravityZone Cloud.  To enable Live Search - [Log in to GravityZone](https://gravityzone.bitdefender.com/). Click on your profile on the upper right side of the screen. From the drop-down menu, select My Company. Go to the Early Access tab. Select one of the programs available on the list. Click the Enroll below the table. Select Enroll to confirm. Your company will gain access to all the features, functionality, and interface changes included in the program.  ![](https://businessinsights.bitdefender.com/hubfs/undefined-Mar-31-2023-05-21-10-8022-PM.png) To locate compromised installations on **macOS**, use the following query:  `SELECT name, bundle_version from apps WHERE name LIKE ‘%3CX%’ AND bundle_version BETWEEN ‘18.11.1213’ AND ‘18.12.416’;` ![](https://businessinsights.bitdefender.com/hubfs/undefined-Mar-31-2023-05-21-47-0032-PM.png) To locate compromised installations on **Windows**, use the following query:  `SELECT name, version FROM programs WHERE name LIKE ‘%3CX%’ AND version BETWEEN ‘18.12.407’ AND ‘18.12.416’;`  ![](https://businessinsights.bitdefender.com/hubfs/undefined-Mar-31-2023-05-22-15-8965-PM.png) Detection of compromised versions was also added to the **GravityZone Endpoint Risk Analytics** module:  ![](https://businessinsights.bitdefender.com/hubfs/undefined-Apr-03-2023-04-49-42-3098-PM.png) Actively monitor the infrastructure for potential exploitation attempts and respond accordingly. We strongly recommend implementing detection and response capabilities to detect any suspicious activity on the network and minimize the dwell time of adversaries. Bitdefender [GravityZone XDR](https://www.youtube.com/watch?v=ReBDrsyyiSY&ab_channel=BitdefenderEnterprise) sensors detect suspicious activity and alert security teams to lateral movement attempts or the establishment of an external connection by the threat actor. This technology can be augmented by good security operations, either in-house or through a managed service like [Bitdefender MDR](https://www.youtube.com/watch?v=TRp7uLYLGiQ).  ## Indicators of compromise An up-to-date and complete list of indicators of compromise is available to Bitdefender Threat Intelligence users. The currently known indicators of compromise can be found in the table below.  ### Files | **File Description** | **SHA256** | **Detection Name** | | --- | --- | --- | | Icon | 210c9882eba94198274ebc787fe8c88311af24932832a7fe1f1ca0261f815c3d | Trojan.ICO.SupplyChainAgent.A | | Icon | 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de | Trojan.ICO.SupplyChainAgent.B | | Icon | 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca | Trojan.ICO.SupplyChainAgent.C | | Icon | 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f | Trojan.ICO.SupplyChainAgent.D | | Icon | 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f | Trojan.ICO.SupplyChainAgent.E | | Icon | 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d | Trojan.ICO.SupplyChainAgent.F | | Icon | a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c | Trojan.ICO.SupplyChainAgent.G | | Icon | c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 | Trojan.ICO.SupplyChainAgent.H | | Icon | c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd | Trojan.ICO.SupplyChainAgent.I | | Icon | d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e | Trojan.ICO.SupplyChainAgent.J | | Icon | d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 | Trojan.ICO.SupplyChainAgent.K | | Icon | d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a | Trojan.ICO.SupplyChainAgent.L | | Icon | e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c | Trojan.ICO.SupplyChainAgent.M | | Icon | f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 | Trojan.ICO.SupplyChainAgent.N | | Icon | f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 | Trojan.ICO.SupplyChainAgent.O | | macOS Installer | 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 | Trojan.MAC.SupplyChainAgent.E | | macOS Installer | e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec | Trojan.MAC.SupplyChainAgent.J | | Windows Installer | 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 | Trojan.SupplyChainAgent.E | | Windows Installer | aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 | Trojan.SupplyChainAgent.E | | macOS dylib bundle | 51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72 | Trojan.MAC.SupplyChainAgent.H | | macOS dylib bundle | 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 | Trojan.MAC.SupplyChainAgent.E | | macOS dylib bundle | ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca | Trojan.MAC.SupplyChainAgent.I | | macOS dylib bundle | b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb | Trojan.MAC.SupplyChainAgent.J | | macOS dylib bundle | e2d161a4a5280ca896acda9ced2ab5c84e100e81e5dd46bf5413eee206b1bfac | Trojan.MAC.SupplyChainAgent.G | | macOS dylib bundle | f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730 | Trojan.MAC.SupplyChainAgent.F | | libffmpeg (macOS Library) | 5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a | Trojan.MAC.SupplyChainAgent.C | | libffmpeg (macOS Library) | 87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c | Trojan.MAC.SupplyChainAgent.C | | libffmpeg (macOS Library) | a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 | Trojan.MAC.SupplyChainAgent.2 | | libffmpeg (macOS Library) | fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 | Trojan.MAC.SupplyChainAgent.1 | | d3dcompiler (Windows Library) | 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 | Trojan.Marte.SupplyChainAgent.C | | ffmpeg (Windows library) | 253f3a53796f1b0fbe64f7b05ae1d66bc2b0773588d00c3d2bf08572a497fa59 | Trojan.SupplyChainAgent.J | | ffmpeg (Windows library) | 396350b12b7626d40d76b0c8814920e5692f5a396a3110432a4f361e93a2d881 | Trojan.SupplyChainAgent.B | | ffmpeg (Windows library) | 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 | Trojan.SupplyChainAgent.E | | ffmpeg (Windows library) | c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 | Trojan.SupplyChainAgent.K | | Final Payload | 2a22798543bd1f97dd5cd626ba9ac6de6d0a744f3cab01faf9dfc238b24e178b | Trojan.SupplyChainAgent.A | | Final Payload | 693f96516f43561ba4ae10f2a08758b42cbf9c75cdafe3263169ff7f26dfd206 | Generic.SupplyChainAgent.A.7C42B0E2 | | Final Payload | 6a0f637546684c90809cf264c22a861c9a07b1ca3b2ef6a359a14d612e392c1a | Generic.SupplyChainAgent.A.79D82208 | | Final Payload | 82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807 | Trojan.SupplyChainAgent.D | | Final Payload | 851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7 | Trojan.SupplyChainAgent.F | | Final Payload | 927668ad4016fcd09f172f9117d575a3a56cb10b1197b74b7e05f14b0d415d2e | Trojan.SupplyChainAgent.D | | Final Payload | aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973 | Trojan.SupplyChainAgent.A | | Final Payload | d67e6ba9be2ae522e05838285acefc2513b61f6ccae159027914a5813fb5f80f | Trojan.SupplyChainAgent.A | | Final Payload | e4dac5422cc1b7f6df6017d2568502fb02756694eeae7c10916314d66898c811 | Trojan.SupplyChainAgent.A | | Final Payload | f5fdefaa5321e2cea02ef8b479de8ec3c5505e956ea1484c84a7abb17231fe24 | Trojan.SupplyChainAgent.A | | Final Payload | b56279136d816a11cf4db9fc1b249da04b3fa3aef4ba709b20cdfbe572394812 | Generic.SupplyChainAgent.B.E9148ED9 | ### Domains | akamaicontainer.com | | --- | | akamaitechcloudservices.com | | azuredeploystore.com | | azureonlinecloud.com | | azureonlinestorage.com | | dunamistrd.com | | glcloudservice.com | | journalide.org | | msedgepackageinfo.com | | msstorageazure.com | | msstorageboxes.com | | officeaddons.com | | officestoragebox.com | | pbxcloudeservices.com | | pbxphonenetwork.com | | pbxsources.com | | qwepoi123098.com | | sbmsa.wiki | | sourceslabs.com | | visualstudiofactory.com | | zacharryblogs.com | ## For the latest information on vulnerabilities such as this one, [subscribe to Business Insights](https://www.bitdefender.com/blog/businessinsights/).   [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) ### Explore More Topics - [Enterprise Security (765)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (206)](https://businessinsights.bitdefender.com/topic/threat-research) - [SMB Security (193)](https://businessinsights.bitdefender.com/topic/smb-security) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [Ransomware (172)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (139)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (136)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (136)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (127)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (121)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Threat Intelligence (82)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [IT Compliance & Regulations (75)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (59)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (55)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (47)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (39)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (24)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (10)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (5)](https://businessinsights.bitdefender.com/topic/podcast) - [AI (2)](https://businessinsights.bitdefender.com/topic/ai) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [VDI, for sure, but which one is best for me?](https://businessinsights.bitdefender.com/vdi-which-one-is-best-for-me?hsLang=en-us) ### [Desktops are the most popular corporate devices among businesses, corporate mobile devices still not widespread, Gartner says](https://businessinsights.bitdefender.com/desktops-corporate-devices-gartner?hsLang=en-us) ### [Desktop-as-a-Service: New Opportunities for the Channel](https://businessinsights.bitdefender.com/daas-new-opportunities?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender\_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Martin Zugec", "url" : "https://businessinsights.bitdefender.com/author/martin-zugec" }, "dateModified" : "2023-05-05T10:43:23.934Z", "datePublished" : "2023-03-31T17:38:55.000Z", "headline" : "Technical Advisory: Software Supply Chain Attack Against 3CX Desktop App", "image" : [ "https://businessinsights.bitdefender.com/hubfs/3CX.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/technical-advisory-software-supply-chain-attack-against-3cx-desktop-app", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```