3CX VOIP Compromised & Supply Chain Threat

Resources & References surrounding the 3CX exploitation:

CrowdStrike’s original Reddit reporting
CrowdStrike’s formal blog post
SentinelOne’s reporting
Discussion on the 3CX forum and public bulletin board
3CX CEO first official notification
Nextron System’s Sigma and YARA rules for detection
Unofficial OTX AlientVault Pulse
Kevin Beaumont’s commentary
Patrick Wardle’s commentary on the Mac variant
Huntress blog

[luketurner]

8:22 it makes sense to masquerade as ffmpeg because VOIP would use it, therefore not raise any initial suspicion

[cheebydi]

This has been a day. Thanks for your summary and as always the amazing work on text and video.
Really looking forward to Mandiants report and possible movement within 3CX.
With the 3CX customer base, I'll just assume whatever the ATP TA wanted to achieve was mostly successful, the last (7d)+24h have been noise.

[BlueFolder_zip]

Great content! Your ability to not only share about the malware, but on possible scope of attack is very insightful.

[birdgamerman]

I am a Partner that installs 3cx for our customers. That was a doozy of days helping customers here

[daniellowrie]

Kudos to you John and the whole Huntress team for all the incredible work you've done to help with this attack. I leaned on this video and your Huntress blog post as references for my own video. My hat is off to you all 😀👍

[JoshWhite]

Thanks for covering this. It made for a fun morning.

[DarkFaken]

This was really amazing work by you, thanks John, you always come through!!

[JzJad]

This field has been my favorite to work in, I love how we all come together to smash the TA's

[fistfulofhummus]

I am glad we caught this early. IR happened today and we are following up tomorrow

[Shakedog]

I feel like a big dummy for whitelisting this when SentinelOne started detecting a threat.

[theblankuser]

That's why it was flagged by Defender today... Damn I REALLY hope they fixed it

[whyherro]

Lol the 3cx CEO isn't taking this breach well

[doinkydeano]

I got wind of this today and started asking on the discord...had a feeling youd be making a vid on it already. Thank you so much for your quick and hard work. I want to be like you when i grow up.

[Catge]

Been dealing with this nightmare for past day...

[SKcdman]

tx a lot for warning and explanation, already phoned customers and tightened firewalls

[jannikmeissner]

Dodged a bullet, I was using 3CX previously, but stopped as I don't like phone calls and wondered what was the point of having a phone system then…

[TheJBerg]

Our org migrated off 3CX years ago due to how difficult it was to maintain and get support for. Still not great that they had this happen to them.

[subro.sengupta]

Nicely explained. I really needed to understand this incident.

PS: I'm from a non tech background and although I didnt understand some of the terminologies used, I understood the gist.

Thank you.

[ghostdancer]

Great writeup on the hack and thanks. The one question I keep asking is why didn't any SAST/DAST/Code review catch this before it showed the IoCs. Its great that every single EDR/XDR can catch this but my bigger concern are what appscan vendors aren't and am I using them today. I read in one of the post that it was digitally signed by Apple meaning they didn't catch it so why isn't anyone concerned about that? Maybe I'm missing something.

[isrgn]

Yeah i was running around all day. I'm glad none of our customers updated yet.