Security firms including CrowdStrike and SentinelOne reported that the desktop app of business phone provider 3CX had been compromised and was delivering malware to customers. Investigators linked the attack to North Korea-nexus hackers.
What happened
- Signed versions of the 3CX DesktopApp for Windows and macOS contained malicious code that downloaded further malware.
- 3CX says its software is used by more than 600,000 companies worldwide.
- Mandiant found the breach started when a 3CX employee installed trojanised trading software, X_Trader, making it one of the first known cascading supply chain attacks.
- Mandiant attributed the activity to a North Korea-nexus group it tracks as UNC4736.
Why it mattered
The attack showed how one compromised supplier can lead to another, and that legitimately signed software cannot be trusted automatically. Many customers had to decide quickly whether to uninstall a business-critical communications tool.
Lessons for organisations
Organisations should keep an inventory of software in use, monitor endpoints for unusual behaviour even from trusted applications, and control what employees can install on corporate devices. Supplier security reviews should also cover how vendors protect their build and code-signing processes.
Source: BleepingComputer
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
