Poisoned Pipeline / Incidents / AS2
3CX Desktop
3CX is a VOIP software company with more than 600000 customers. In April 2023, the company was subject to an attack that infected their 3CX desktop software with malware. It is suspected to be a nation state attack carried out by North Korea. The attack was facilitated by attacking the supply chain of a trading software company, Trading Technologies.
Mapped techniques
- T0191 Malicious code in artifacts
- T0153 Compromised developer workstation
- T0113 Compromised user account
- T0137 Weak authentication methods
- T0131 Overprivileged user account
- T0184 Harvesting sensitive information from files
- T0176 Disable or misconfigure security measures
- T0146 Misconfigured audit logs settings
pre-supply-chain Trading Technologies
The attackers trojanized the software X_TRADER. The software was digitally signed by "Trading Technologies" which strongly suggests that the firm's supply chain was breached.
supply-chain 3CX
A 3CX employee desktop is infected with the trojanized X_TRADER software. There is evidence that the vendor site was compromised and infected with an exploit kit that distributed the trojanized software
Attackers harvested user credentials from infected machines
Attackers connected to the company VPN using credentials, as a second factor authentication was not enabled.
The compromised user had access to the entire network and the build system.
3CX used to save their application password unencrypted/un-hashed in the file system. It is not clear if that was used as part of this attack, but the fact is that they released a new client that resolves this issue.
The EDR (if it existed) didn't detect malware on the desktop. The build system was not hardened (network/application). Code scanning tools didn't exist/were not configured correctly/nobody looked into the results.
Access and changes to the build system and content should have been logged and alerted upon.
The attacker infected the 3CX software with a backdoor.