Vulnerabilityhigh
North Korean Hackers Uncovered as Mastermind in 3CX Supply Chain Attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-29059 | 3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023 | 7.8 | 4% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | akamaicontainer.com | r command-and-control (C2) servers: azureonlinecloud[.]com, akamaicontainer[.]com, journalide[.]org, and msboxonline[.]com. 3CX CEO Nick Ga |
| domain | azureonlinecloud.com | to contact at least four command-and-control (C2) servers: azureonlinecloud[.]com, akamaicontainer[.]com, journalide[.]org, and msboxonline |
| domain | journalide.org | C2) servers: azureonlinecloud[.]com, akamaicontainer[.]com, journalide[.]org, and msboxonline[.]com. 3CX CEO Nick Galea, in a forum po |
| domain | msboxonline.com | necloud[.]com, akamaicontainer[.]com, journalide[.]org, and msboxonline[.]com. 3CX CEO Nick Galea, in a forum post last week, said the |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Apr 12, 2023 Software Security / Cyber Attack Enterprise communications service provider 3CX confirmed that the supply chain attack targeting its desktop application for Windows and macOS was the handiwork of a threat actor with North Korean nexus.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.