Technical Advisory: Software Supply Chain Attack Against 3CX Desktop App

On March 29, 2023, security researchers documented a malicious campaign targeting 3CX Desktop App customers. 3CX Desktop App is a software application developed by 3CX, a Voice over Internet Protocol (VoIP) solutions provider with 12M+ daily users. This application is available for Windows, macOS, Linux, and mobile. 

Update 7 of the 3CX Desktop App application for Windows and macOS was compromised by threat actors believed to be linked to North Korea. Trojanized versions of the 3CX Desktop App installers (.msi for Windows, .dmg for macOS) were published on the developer’s website. As of the writing of this article, the method by which this update was compromised remains unknown. 

Description of vulnerability

The installer for Windows would extract the legitimate 3CXDesktopApp.exe (fully functional), but also the malicious libraries ffmpeg.dll and d3dcompiler_47.dll. When the application is executed, it uses a technique called DLL sideloading (read our DLL sideloading explainer) to load the malicious ffmpeg.dll library in memory. 

ffmpeg.dll library decrypts the payload from the d3dcompiler_47.dll library and executes it as a shellcode. Malware is suspended for 1-4 weeks as a detection evasion technique, after this period it will try to download a .ico file from the domain githubusercontent[.]com (no longer available) and extract from it an address of a command & control (C2) server. This domain hosted multiple icon files, each associated with a different C2 domain. 

The installer for macOS is a simplified version of the trojanized installer for Windows. The malicious library libffmpeg.dylib includes an embedded list of hardcoded C2 servers. This list is identical for both Windows and macOS versions. 

Multiple Windows and macOS versions of the software were affected: 

• Windows – versions 18.12.407, 18.12.416 

• macOS – versions 18.11.1213, 18.12.402, 18.12.407, 18.12.416 

Conclusion and recommendations

Bitdefender continues monitoring the situation, but we haven’t detected any active exploitation attempts for our customers. Below are the detection names used in the Bitdefender GravityZone platform: 

Windows

• Trojan.SupplyChainAgent.A 
• Trojan.SupplyChainAgent.B 
• Trojan.SupplyChainAgent.C 

macOS

• Trojan.MAC.SupplyChainAgent.1 
• Trojan.MAC.SupplyChainAgent.2

We also recommend 3CX customers stay up to date with the latest advisory, as the situation is still developing. Conduct an extensive infrastructure and software application audit to identify all systems where compromised software was deployed.

To locate the vulnerable versions of 3CX Desktop App software in your environment, you can use Live Search query feature of the GravityZone platform.

With Live Search, you can retrieve information about events and system statistics directly from online endpoints using OSquery, an operating system instrumentation framework that uses the SQLite query language. This is currently available for customers that have enrolled in the Early Access program available in GravityZone Cloud. 

To enable Live Search – Log in to GravityZone. Click on your profile on the upper right side of the screen. From the drop-down menu, select My Company. Go to the Early Access tab. Select one of the programs available on the list. Click the Enroll below the table. Select Enroll to confirm. Your company will gain access to all the features, functionality, and interface changes included in the program. 

To locate compromised installations on macOS, use the following query: 
SELECT name, bundle_version from apps WHERE name LIKE ‘%3CX%’ AND bundle_version BETWEEN ‘18.11.1213’ AND ‘18.12.416’;

To locate compromised installations on Windows, use the following query: 
SELECT name, version FROM programs WHERE name LIKE ‘%3CX%’ AND version BETWEEN ‘18.12.407’ AND ‘18.12.416’; 

Actively monitor the infrastructure for potential exploitation attempts and respond accordingly. We strongly recommend implementing detection and response capabilities to detect any suspicious activity on the network and minimize the dwell time of adversaries. Bitdefender GravityZone XDR sensors detect suspicious activity and alert security teams to lateral movement attempts or the establishment of an external connection by the threat actor. This technology can be augmented by good security operations, either in-house or through a managed service like Bitdefender MDR. 

For the latest information on vulnerabilities such as this one, subscribe to Business Insights.