CTI Weekly: New supply chain campaign leverages the popular 3CX VOIP desktop client

Researchers recently reported on a supply chain compromise campaign that allegedly used a digitally signed and malicious copy of the 3CX Voice Over Internet Protocol desktop client to target the company’s clients. 3CX is a prominent software development company for VoIP IPBX, with a customer base of over 600,000 companies and more than 12 million daily users, including notable clients such as American Express, BMW, and the UK’s National Health Service. The attackers are targeting both Windows and macOS users of the compromised 3CX softphone app, deploying second-stage payloads, and performing hands-on-keyboard activity in a small number of cases. The malware also includes an information-stealer capable of stealing data and stored credentials from various user profiles.

The exploitation of 3CX DesktopApp has been identified as CVE-2023-29059 (OVSS:42). The CEO of 3CX stated that the compromise occurred as a result of an upstream vendor becoming infected, suggesting that FFmpeg was responsible as the malware payload resides there. However, FFmpeg has disputed this claim, stating that its source code was not compromised. These ongoing attacks are a reminder of the importance of supply chain security, and companies must remain vigilant to prevent such incidents from occurring.

Other news:

Nation-State

Cybercriminal

Novel Malware

Subscribe below for more and to discover other significant cyber criminals, nation-state and hacktivist news.