Overview
On March 29, a massive supply chain compromise in 3CX software resulted in malware being installed globally across multiple industries. It is similar to the other high-profile supply chain attacks (like SolarWinds and Kaseya) in that rather than targeting a single organization, the criminals target a popular service or software provided to many large organizations. With one single compromise of the supplier, dozens and potentially hundreds of organizations may fall in turn.
Trustwave is diligently monitoring the situation for exposure and associated attacks and will provide updates here as we have them.
In this case, the supplier is 3CX, a software company that makes a very popular VOIP software phone system. These 3CX software phones are very popular and by 3CX’s own count they service over 600,000 companies globally and more than 12 million users daily. Their client list contains dozens of highly recognizable corporate entities.
Affected Versions
The trojanized binary affects both Electron Windows App (versions 18.12.407 & 18.12.416) as well as Electron Mac App (versions 18.11.1213, 18.12.402, 18.12.407 & 18.12.416). Users that either installed an update (Update 7) or installed a fresh instance of these versions may be affected. As of March 30, Shodan shows close to a quarter of a million publicly exposed 3CX management systems.
Figure 1: Shodan results for publicly exposed 3CX management systems
The full attack results in an Infostealer strain of malware on the victim system via a trojanized DLL.
Attack Chain
Upon installing either the full software (via MSI) or the update (Update 7), the software will load ffmpeg.dll which, in turn, will sideload d3dcompiler_47.dll. ffmpeg.dll is then used to extract and decrypt the second stage malware from d3dcompiler_47.dll. That second stage malware is encrypted using RC4 with a static key of "3jB(2bsG#@c7", which many organizations have pointed to as a common static key used in other malware attributed to North Korean (DPRK) state sponsored threat actors.
The second stage malware will then wait seven days before attempting to download one of sixteen Windows icon files (.ICO) from a public GitHub repository (already taken down). These fully functional icon files have a base64 string appended to the end of the file which provides the malware with the URI for its C2 server. At least one of the icons was originally uploaded to GitHub on 7.Dec.2022.
After connecting to the C2 server defined in the .ICO file, the final malware stage will be downloaded to the victim system. This final stage is a novel, previously unseen Infostealer. The Infostealer grabs standard system info and browsing history from Chrome, Edge, Brave, and Firefox browsers.
Remediation
3CX is currently working on an update to patch the malicious code. In the meantime, 3CX recommends that users uninstall any current version and switch to the unaffected 3CX Progressive Web App (PWA) version of its software.
Attribution
Several organizations attribute this attack to North Korea (DPRK), specifically Lazarus or a sub-organization of that group. Trustwave has not confirmed any attribution at this time.
IOCs
Windows Hashes
3CXDesktopapp-18.12.407.msi
| Hash Type | Hash |
| SHA256 | aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 |
| SHA1 | bea77d1e59cf18dce22ad9a2fad52948fd7a9efa |
| MD5 | f3d4144860ca10ba60f7ef4d176cc736 |
3CXDesktopApp.exe (v18.12.407)
| Hash Type | Hash |
| SHA256 | dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc |
| SHA1 | 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea |
| MD5 | bb915073385dd16a846dfa318afa3c19 |
3CXDesktopApp.exe (v18.12.407) Additional Hashes
| Hash Type | Hash |
| SHA256 | 54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02 |
| SHA1 | 480dc408ef50be69ebcf84b95750f7e93a8a1859 |
| MD5 | 08d79e1fffa244cc0dc61f7d2036aca9 |
3CXDesktopApp-18.12.416.msi
| Hash Type | Hash |
| SHA256 | 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 |
| SHA1 | bfecb8ce89a312d2ef4afc64a63847ae11c6f69e |
| MD5 | 0eeb1c0133eb4d571178b2d9d14ce3e9 |
3CXDesktopApp.exe (v18.12.416)
| Hash Type | Hash |
| SHA256 | fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 |
| SHA1 | 8433a94aedb6380ac8d4610af643fb0e5220c5cb |
| MD5 | 9833a4779b69b38e3e51f04e395674c6 |
3CXDesktopApp.exe (v18.12.416) Additional Hashes
| Hash Type | Hash |
| SHA256 | a60a61bf844bc181d4540c9fac53203250a982e7c3ad6153869f01e19cc36203 |
| SHA1 | 413d9cbfcbf8d1e8304eab0aa5484f5eec5185f5 |
| MD5 | 704db9184700481a56e5100fb56496ce |
ffmpeg.dll
| Hash Type | Hash |
| SHA256 | 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 |
| SHA1 | bf939c9c261d27ee7bb92325cc588624fca75429 |
| MD5 | 74bc2d0b6680faa1a5a76b27e5479cbc |
d3dcompiler_47.dll
| Hash Type | Hash |
| SHA256 | 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 |
| SHA1 | 20d554a80d759c50d6537dd7097fed84dd258b3e |
| MD5 | 82187ad3f0c6c225e2fba0c867280cc9 |
Final stage Infostealer malware
| Hash Type | Hash |
| SHA256 | 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 |
| SHA1 | 3b3e778b647371262120a523eb873c20bb82beaf |
| MD5 | 7faea2b01796b80d180399040bb69835 |
MacOS Hashes
3CXDesktopApp-18.11.1213.dmg
| Hash Type | Hash |
| SHA256 | 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 |
| SHA1 | 19f4036f5cd91c5fc411afc4359e32f90caddaac |
| MD5 | 5729fb29e3a7a90d2528e3357bd15a4b |
3CXDesktopApp.app (v18.11.1213)
| Hash Type | Hash |
| SHA256 | 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 |
| SHA1 | 5d833bcc679db38a45111269e727ec58b75c8d31 |
| MD5 | 3703770e32820397c6e7e1e1221e6d0d |
3CXDesktopapp-latest.dmg (v18.12.416)
| Hash Type | Hash |
| SHA256 | e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec |
| SHA1 | 3dc840d32ce86cebf657b17cef62814646ba8e98 |
| MD5 | d5101c3b86d973a848ab7ed79cd11e5a |
3CXDesktopApp.app (v18.12.416)
| Hash Type | Hash |
| SHA256 | b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb |
| SHA1 | f3487a1324f4c11b35504751a5527bc60eb95382 |
| MD5 | ca8c0385ce2b8bdd19423c8b98a5924b |
libffmpeg.dylib
| Hash Type | Hash |
| SHA256 | a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 |
| SHA1 | 769383fc65d1386dd141c960c9970114547da0c2 |
| MD5 | 660ea9b8205fbd2da59fefd26ae5115c |
C2 Domains
(NOTE: These Domains have been taken down, but existing infected systems may still try to reach out to these hosts)
| akamaicontainer[.]com |
| msedgepackageinfo[.]com |
| akamaitechcloudservices[.]com |
| msstorageazure[.]com |
| azuredeploystore[.]com |
| msstorageboxes[.]com |
| azureonlinecloud[.]com |
| officeaddons[.]com |
| azureonlinestorage[.]com |
| officestoragebox[.]com |
| dunamistrd[.]com |
| pbxcloudeservices[.]com |
| glcloudservice[.]com |
| pbxphonenetwork[.]com |
| qwepoi123098[.]com |
| zacharryblogs[.]com |
| sbmsa[.]wiki |
| pbxsources[.]com |
| sourceslabs[.]com |
| journalide[.]org |
| visualstudiofactory[.]com |
C2 URIs
| https[:]//www.3cx[.]com/blog/event-trainings/ |
| https[:]//github[.]com/IconStorages/images |
| https[:]//raw[.]githubusercontent[.]com/IconStorages/images/main/icon%d.ico |
| https[:]//akamaitechcloudservices[.]com/v2/storage |
| https[:]//azureonlinestorage[.]com/azure/storage |
| https[:]//msedgepackageinfo[.]com/microsoft-edge |
| https[:]//glcloudservice[.]com/v1/console |
| https[:]//pbxsources[.]com/exchange |
| https[:]//msstorageazure[.]com/window |
| https[:]//officestoragebox[.]com/api/session |
| https[:]//visualstudiofactory[.]com/workload |
| https[:]//azuredeploystore[.]com/cloud/services |
| https[:]//msstorageboxes[.]com/office |
| https[:]//officeaddons[.]com/technologies |
| https[:]//sourceslabs[.]com/downloads |
| https[:]//zacharryblogs[.]com/feed |
| https[:]//pbxcloudeservices[.]com/phonesystem |
| https[:]//pbxphonenetwork[.]com/voip |
| https[:]//msedgeupdate[.]net/Windows |
| https[:]//msedge[.]com/Windows |
| https[:]//sbmsa[.]wiki/blog/_insert |
References
3CX Alert: https://www.3cx.com/blog/news/desktopapp-security-alert/
3CX Remediation: https://www.3cx.com/blog/news/desktopapp-security-alert-updates/
Overview
On March 29, a massive supply chain compromise in 3CX software resulted in malware being installed globally across multiple industries. It is similar to the other high-profile supply chain attacks (like SolarWinds and Kaseya) in that rather than targeting a single organization, the criminals target a popular service or software provided to many large organizations. With one single compromise of the supplier, dozens and potentially hundreds of organizations may fall in turn.
Trustwave is diligently monitoring the situation for exposure and associated attacks and will provide updates here as we have them.
In this case, the supplier is 3CX, a software company that makes a very popular VOIP software phone system. These 3CX software phones are very popular and by 3CX’s own count they service over 600,000 companies globally and more than 12 million users daily. Their client list contains dozens of highly recognizable corporate entities.
Affected Versions
The trojanized binary affects both Electron Windows App (versions 18.12.407 & 18.12.416) as well as Electron Mac App (versions 18.11.1213, 18.12.402, 18.12.407 & 18.12.416). Users that either installed an update (Update 7) or installed a fresh instance of these versions may be affected. As of March 30, Shodan shows close to a quarter of a million publicly exposed 3CX management systems.
Figure 1: Shodan results for publicly exposed 3CX management systems
The full attack results in an Infostealer strain of malware on the victim system via a trojanized DLL.
Attack Chain
Upon installing either the full software (via MSI) or the update (Update 7), the software will load ffmpeg.dll which, in turn, will sideload d3dcompiler_47.dll. ffmpeg.dll is then used to extract and decrypt the second stage malware from d3dcompiler_47.dll. That second stage malware is encrypted using RC4 with a static key of "3jB(2bsG#@c7", which many organizations have pointed to as a common static key used in other malware attributed to North Korean (DPRK) state sponsored threat actors.
The second stage malware will then wait seven days before attempting to download one of sixteen Windows icon files (.ICO) from a public GitHub repository (already taken down). These fully functional icon files have a base64 string appended to the end of the file which provides the malware with the URI for its C2 server. At least one of the icons was originally uploaded to GitHub on 7.Dec.2022.
After connecting to the C2 server defined in the .ICO file, the final malware stage will be downloaded to the victim system. This final stage is a novel, previously unseen Infostealer. The Infostealer grabs standard system info and browsing history from Chrome, Edge, Brave, and Firefox browsers.
Remediation
3CX is currently working on an update to patch the malicious code. In the meantime, 3CX recommends that users uninstall any current version and switch to the unaffected 3CX Progressive Web App (PWA) version of its software.
Attribution
Several organizations attribute this attack to North Korea (DPRK), specifically Lazarus or a sub-organization of that group. Trustwave has not confirmed any attribution at this time.
IOCs
Windows Hashes
3CXDesktopapp-18.12.407.msi
| Hash Type | Hash |
| SHA256 | aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 |
| SHA1 | bea77d1e59cf18dce22ad9a2fad52948fd7a9efa |
| MD5 | f3d4144860ca10ba60f7ef4d176cc736 |
3CXDesktopApp.exe (v18.12.407)
| Hash Type | Hash |
| SHA256 | dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc |
| SHA1 | 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea |
| MD5 | bb915073385dd16a846dfa318afa3c19 |
3CXDesktopApp.exe (v18.12.407) Additional Hashes
| Hash Type | Hash |
| SHA256 | 54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02 |
| SHA1 | 480dc408ef50be69ebcf84b95750f7e93a8a1859 |
| MD5 | 08d79e1fffa244cc0dc61f7d2036aca9 |
3CXDesktopApp-18.12.416.msi
| Hash Type | Hash |
| SHA256 | 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 |
| SHA1 | bfecb8ce89a312d2ef4afc64a63847ae11c6f69e |
| MD5 | 0eeb1c0133eb4d571178b2d9d14ce3e9 |
3CXDesktopApp.exe (v18.12.416)
| Hash Type | Hash |
| SHA256 | fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 |
| SHA1 | 8433a94aedb6380ac8d4610af643fb0e5220c5cb |
| MD5 | 9833a4779b69b38e3e51f04e395674c6 |
3CXDesktopApp.exe (v18.12.416) Additional Hashes
| Hash Type | Hash |
| SHA256 | a60a61bf844bc181d4540c9fac53203250a982e7c3ad6153869f01e19cc36203 |
| SHA1 | 413d9cbfcbf8d1e8304eab0aa5484f5eec5185f5 |
| MD5 | 704db9184700481a56e5100fb56496ce |
ffmpeg.dll
| Hash Type | Hash |
| SHA256 | 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 |
| SHA1 | bf939c9c261d27ee7bb92325cc588624fca75429 |
| MD5 | 74bc2d0b6680faa1a5a76b27e5479cbc |
d3dcompiler_47.dll
| Hash Type | Hash |
| SHA256 | 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 |
| SHA1 | 20d554a80d759c50d6537dd7097fed84dd258b3e |
| MD5 | 82187ad3f0c6c225e2fba0c867280cc9 |
Final stage Infostealer malware
| Hash Type | Hash |
| SHA256 | 8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423 |
| SHA1 | 3b3e778b647371262120a523eb873c20bb82beaf |
| MD5 | 7faea2b01796b80d180399040bb69835 |
MacOS Hashes
3CXDesktopApp-18.11.1213.dmg
| Hash Type | Hash |
| SHA256 | 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 |
| SHA1 | 19f4036f5cd91c5fc411afc4359e32f90caddaac |
| MD5 | 5729fb29e3a7a90d2528e3357bd15a4b |
3CXDesktopApp.app (v18.11.1213)
| Hash Type | Hash |
| SHA256 | 92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61 |
| SHA1 | 5d833bcc679db38a45111269e727ec58b75c8d31 |
| MD5 | 3703770e32820397c6e7e1e1221e6d0d |
3CXDesktopapp-latest.dmg (v18.12.416)
| Hash Type | Hash |
| SHA256 | e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec |
| SHA1 | 3dc840d32ce86cebf657b17cef62814646ba8e98 |
| MD5 | d5101c3b86d973a848ab7ed79cd11e5a |
3CXDesktopApp.app (v18.12.416)
| Hash Type | Hash |
| SHA256 | b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb |
| SHA1 | f3487a1324f4c11b35504751a5527bc60eb95382 |
| MD5 | ca8c0385ce2b8bdd19423c8b98a5924b |
libffmpeg.dylib
| Hash Type | Hash |
| SHA256 | a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 |
| SHA1 | 769383fc65d1386dd141c960c9970114547da0c2 |
| MD5 | 660ea9b8205fbd2da59fefd26ae5115c |
C2 Domains
(NOTE: These Domains have been taken down, but existing infected systems may still try to reach out to these hosts)
| akamaicontainer[.]com |
| msedgepackageinfo[.]com |
| akamaitechcloudservices[.]com |
| msstorageazure[.]com |
| azuredeploystore[.]com |
| msstorageboxes[.]com |
| azureonlinecloud[.]com |
| officeaddons[.]com |
| azureonlinestorage[.]com |
| officestoragebox[.]com |
| dunamistrd[.]com |
| pbxcloudeservices[.]com |
| glcloudservice[.]com |
| pbxphonenetwork[.]com |
| qwepoi123098[.]com |
| zacharryblogs[.]com |
| sbmsa[.]wiki |
| pbxsources[.]com |
| sourceslabs[.]com |
| journalide[.]org |
| visualstudiofactory[.]com |
C2 URIs
| https[:]//www.3cx[.]com/blog/event-trainings/ |
| https[:]//github[.]com/IconStorages/images |
| https[:]//raw[.]githubusercontent[.]com/IconStorages/images/main/icon%d.ico |
| https[:]//akamaitechcloudservices[.]com/v2/storage |
| https[:]//azureonlinestorage[.]com/azure/storage |
| https[:]//msedgepackageinfo[.]com/microsoft-edge |
| https[:]//glcloudservice[.]com/v1/console |
| https[:]//pbxsources[.]com/exchange |
| https[:]//msstorageazure[.]com/window |
| https[:]//officestoragebox[.]com/api/session |
| https[:]//visualstudiofactory[.]com/workload |
| https[:]//azuredeploystore[.]com/cloud/services |
| https[:]//msstorageboxes[.]com/office |
| https[:]//officeaddons[.]com/technologies |
| https[:]//sourceslabs[.]com/downloads |
| https[:]//zacharryblogs[.]com/feed |
| https[:]//pbxcloudeservices[.]com/phonesystem |
| https[:]//pbxphonenetwork[.]com/voip |
| https[:]//msedgeupdate[.]net/Windows |
| https[:]//msedge[.]com/Windows |
| https[:]//sbmsa[.]wiki/blog/_insert |
References
3CX Alert: https://www.3cx.com/blog/news/desktopapp-security-alert/
3CX Remediation: https://www.3cx.com/blog/news/desktopapp-security-alert-updates/
