Compromised 3CX Desktop Updates Delivered Malware Through a Multi-Stage Supply-Chain Attack

Mar 30, 2023 · Original article ↗

Summary

Huntress traced malicious 3CX DesktopApp updates for Windows and macOS through a multi-stage loader to encrypted payloads and command-and-control servers. DPRK attribution remained unconfirmed; users were urged to uninstall the client.

Key points

Huntress reported that legitimate 3CX DesktopApp updates delivered malware. The listed affected versions were 18.12.407 and 18.12.416 for Windows, and 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 for Mac.
Huntress found that the backdoored ffmpeg.dll loaded d3dcompiler_47.dll, which contained an encrypted payload; the extracted shellcode included another PE loader.
The later-stage payload reportedly waited seven days before contacting command-and-control servers, then used icon files hosted in the github[.]com/IconStorages/images repository to obtain encrypted data and select a C2 URL.
Huntress said it had sent 2,783 incident reports for partner systems where 3CXDesktopApp.exe matched known malicious hashes; it monitored a pool of about 8,000 hosts running 3CX software.
Huntress said the GitHub repository hosting the C2 endpoints had been taken offline, but the overall impact and whether attackers retained access to the 3CX supply chain were unknown.
The security community’s prevailing assessment pointed to a DPRK threat actor, but Huntress said attribution was not definitive.
3CX’s stated recommendation was to uninstall the desktop client while it prepared a new release. Huntress also shared a PowerShell checking script; Windows Defender detected the chain as Trojan:Win64/SamScissors.

Article Details

Attack Vectors: Compromised 3CX DesktopApp updates delivered malware through the legitimate software update process.
The backdoored ffmpeg.dll loaded d3dcompiler_47.dll, which contained an encrypted payload.
The payload accessed attacker-controlled GitHub repository content containing encrypted data and C2 URLs, then selected an external C2 URL.
Defensive Notes: 3CX recommended uninstalling the desktop client while preparing a non-malicious update; Huntress also urged removal where possible.
Huntress provided a PowerShell script to check 3CX locations and versions against malicious hashes.
Huntress observed a process lineage of explorer.exe spawning 3CXDesktopApp.exe, which spawned another 3CXDesktopApp.exe with the command line ending in "autoLaunch"; it advised correlating this with known malicious parent hashes.
Huntress reported that Windows Defender detected the attack chain as Trojan:Win64/SamScissors.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`akamaicontainer[.]com`	Listed in the article's Indicators of Attack domain list.
DOMAIN	`akamaitechcloudservices[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`azuredeploystore[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`azureonlinecloud[.]com`	Listed in the article's Indicators of Attack domain list.
DOMAIN	`azureonlinestorage[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`dunamistrd[.]com`	Listed in the article's Indicators of Attack domain list.
DOMAIN	`glcloudservice[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`journalide[.]org`	Listed in the article's Indicators of Attack domain list.
DOMAIN	`msedgepackageinfo[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`msedgeupdate[.]net`	Domain identified in the article as a C2 endpoint; an earlier version of the repository's icon data referenced it.
DOMAIN	`msstorageazure[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`msstorageboxes[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`officeaddons[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`officestoragebox[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`pbxcloudeservices[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`pbxphonenetwork[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`pbxsources[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`qwepoi123098[.]com`	Listed in the article's Indicators of Attack domain list.
DOMAIN	`sbmsa[.]wikisourceslabs[.]com`	Listed in the article's Indicators of Attack domain list.
DOMAIN	`sourceslabs[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`visualstudiofactory[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
DOMAIN	`zacharryblogs[.]com`	Domain in the decrypted URLs identified as possible external C2 infrastructure.
SHA256	`54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02`	Known malicious SHA256 hash for 3CXDesktopApp.exe version 18.12.407.
SHA256	`5d99efa36f34aa6b43cd81e77544961c5c8d692c96059fef92c2df2624550734`	Known malicious SHA256 hash for 3CXDesktopApp.exe version 18.12.416.
SHA256	`a60a61bf844bc181d4540c9fac53203250a982e7c3ad6153869f01e19cc36203`	Known malicious SHA256 hash for 3CXDesktopApp.exe version 18.12.416.
SHA256	`d45674f941be3cca2fbc1af42778043cc18cd86d95a2ecb9e6f0e212ed4c74ae`	Known malicious SHA256 hash for 3CXDesktopApp.exe version 18.12.407.
URL	`hxxps[:]//github[.]com/IconStorages/images`	Specific repository used to host icon files containing encrypted data and C2 endpoints; the article reports it was taken offline.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/IconStorages/images/main/icon%d.ico`	Specific raw GitHub-hosted icon resource accessed by the final payload as part of retrieving data used to identify C2 endpoints.