3CX Supply Chain Attack: A Sophisticated Cybersecurity Incident

The world of cybersecurity has been shaken again, as 3CX, a leading enterprise communications software maker, confirmed that multiple versions of its desktop app for Windows and macOS are affected by a supply chain attack. This incident has raised concerns about the security of supply chains and the risks involved with third-party dependencies. In this blog post, we'll explore the details of the 3CX supply chain attack and what you can do to protect yourself.

• What is the 3CX Supply Chain Attack?

The 3CX supply chain attack involved a compromise of the software build pipeline to distribute Windows and macOS versions of the app package, or alternatively, the poisoning of an upstream dependency. The attack was discovered on or around March 22, 2023, and it's currently unknown how extensive it is. The attackers used a sophisticated technique called DLL side-loading to load a rogue library called "ffmpeg.dll" that's designed to read encrypted shellcode from another DLL called "d3dcompiler_47.dll."

• How Does the Attack Work?

The DLL side-loading technique allowed the attackers to access a GitHub repository to retrieve an ICO file containing URLs hosting the final-stage payload, an information stealer (dubbed ICONIC Stealer or SUDDENICON) capable of harvesting system information and sensitive data stored in web browsers. The shellcode utilized in the attack is a byte-to-byte match to prior samples seen in incidents exclusively attributed to the Lazarus Group, a North Korea-aligned state-sponsored actor. The macOS attack chain bypassed Apple's notarization checks to download an unknown payload from a command-and-control (C2) server that's currently unresponsive.

• Who's Behind the Attack?

Cybersecurity firm CrowdStrike has attributed the attack with high confidence to Labyrinth Chollima (aka Nickel Academy), a North Korea-aligned state-sponsored actor. This group has been active since at least 2009 and typically targets crypto and financial organizations to generate revenue. They're likely affiliated with Bureau 121 of the DPRK's Reconnaissance General Bureau (RGB) and primarily conduct espionage operations and revenue generation schemes.

• What's the Impact of the Attack?

The 3CX supply chain attack has raised concerns about the security of supply chains and the risks involved with third-party dependencies. The attack has compromised the security and privacy of users' systems and data, and it may have far-reaching consequences. As of now, the scale of the attack is unknown, and it's unclear how many users have been affected. The incident highlights the need for companies to implement robust security measures to protect themselves and their customers from such attacks.

• What Can You Do to Protect Yourself?

If you're a user of 3CX's desktop app for Windows or macOS, you need to take action to protect yourself. 3CX is urging its customers of self-hosted and on-premise versions of the software to update to version 18.12.422. If you're using the 3CX Hosted or StartUP versions, you don't need to update your servers as they will be updated automatically. It's also essential to implement additional security measures, such as antivirus software, firewalls, and intrusion detection systems, to protect your systems and data from future attacks.

• Conclusion

The 3CX supply chain attack is a significant cybersecurity incident that highlights the risks involved with third-party dependencies and the need for companies to implement robust security measures. As cyber threats Continue threats continue to evolve and become more sophisticated, with supply chain attacks being one of the latest tactics used by threat actors. Supply chain attacks target the software supply chain, seeking to infiltrate and exploit vulnerabilities within the development process.

In the latest incident, enterprise communications software maker 3CX fell victim to a supply chain attack affecting multiple versions of its desktop app for Windows and macOS. The attack is believed to have taken place in March 2023, with preparations starting as early as February 2022.

The scale of the attack is currently unknown, but evidence suggests that it involved the compromise of 3CX's software build pipeline or the poisoning of an upstream dependency. The attack leveraged a technique called DLL side-loading to load a rogue library that could read encrypted shellcode from another DLL.

The Windows version of the attack utilized an information stealer called ICONIC Stealer or SUDDENICON, capable of harvesting system information and sensitive data stored in web browsers. The macOS version bypassed Apple's notarization checks and downloaded an unknown payload from an unresponsive command-and-control server.

The attack has been attributed with high confidence to Labyrinth Chollima (aka Nickel Academy), a North Korea-aligned state-sponsored actor. Labyrinth Chollima is a subset of the Lazarus Group, which has been active since at least 2009 and primarily conducts espionage operations and revenue generation schemes.

To address the attack, 3CX has engaged the services of Google-owned Mandiant to review the incident. It has also urged customers of self-hosted and on-premise versions of the software to update to the latest version, and it will automatically update its Hosted and StartUP users' servers.

As supply chain attacks continue to increase in frequency and complexity, it is essential for organizations to prioritize their cybersecurity measures. They should take proactive steps to secure their software development processes, regularly audit their supply chain, and implement strong security controls and protocols to detect and respond to potential breaches. By doing so, organizations can better protect themselves from the ever-evolving threat landscape.