TF-MAL-osx.3cx_backdoor
📛 Threat Title
Malware family: 3CX Backdoor
Description
ThreatFox malware family `osx.3cx_backdoor`. Printable name: 3CX Backdoor.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies.
-
web:blog.qualys.com
Qualys TRU team analyses the 3CX Supply Chain Compromise and provides Detection, Mitigation and Threat Hunting details.
-
web:cloud.google.com
Mandiant Consulting's investigation of the 3CX supply chain compromise has uncovered the initial intrusion vector: a malware -laced software package distributed via an earlier software supply chain compromise that began with a tampered installer for X_TRADER, a software package provided by Trading Technologies (Figure 1).
-
web:malpedia.caad.fkie.fraunhofer.de
According to CrowdStrike, this backdoor was discovered being embedded in a legitimate, signed version of 3CXDesktopApp, and thus constitutes a supply chain attack.
-
web:traceprotocol.substack.com
The 3CX breach is a textbook case of invisible malware hitching a ride inside trusted update channels. Supply chain trust must be earned, checked, and continuously re-verified.
-
web:www.cisa.gov
CISA is aware of open-source reports describing a supply chain attack against 3CX software and their customers. According to the reports, 3CXDesktopApp — a voice and video conferencing app — was trojanized, potentially leading to multi-staged attacks against users employing the vulnerable app.
-
web:www.cyberstash.com
Mitigation To prevent the 3CX Supply Chain Attack and similar incidents, follow these steps: Upgrade to the latest version of the software: Ensure that you have the most recent version of 3CX installed. This will include security patches and fixes that address vulnerabilities exploit-ed in the attack.
-
web:www.paloaltonetworks.com
Cortex XDR's AI stopped the 3CX supply chain attack days before the security industry knew it existed. See how behavioral detection caught what signatures missed.
-
web:www.sentinelone.com
Further incident response work at 3CX by Mandiant initially led to identification of a backdoor dubbed SIMPLESEA in the 3CX environment. An update from Mandiant subsequently corrected this analysis and identified the backdoor as POOLRAT, a known Lazarus malware family .
-
web:www.zscaler.com
On March 29th 2023, CrowdStrike published a blog outlining a supply chain attack leveraging the 3CXDesktopApp - a softphone application from 3CX . The ThreatLabz Team immediately started hunting for IoCs on the Zscaler Cloud.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.