Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)
AI summary · glm-5.3-flashSummaries by Vani AI
Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.
Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.
Key facts
- Malicious ffmpeg.dll decrypts d3dcompiler_47.dll with RC4 and executes embedded shellcode.
- Windows (.msi) and macOS (.dmg) installers from the developer's site were affected.
- Cortex Xpanse fingerprinted 247,277 IPs in 199 countries running 3CX applications.
- Shellcode sleeps 1-4 weeks before C2 beaconing via GitHub-hosted icon files.
- Shellcode blocked at 127 Cortex XDR customers between March 9-30, 2023.
- Vendors
- Palo Alto Networks3CX
- Organizations
- Unit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3cx.com | w glcloudservice[.]com/v1/status pbxsources[.]com/queue www.3cx[.]com/blog/event-trainings/ Note that the www.3cx[.]com URL abo |
| domain | akamaicontainer.com | iofactory.com|.*zacharryblogs.com" OR dns_query_name ~ = ".*akamaicontainer.com|.*akamaitechcloudservices.com|.*azuredeploystore.com|.*azur |
| domain | akamaitechcloudservices.com | 62a88896c57bbe3b6456bd090 icon10.ico and icon11.ico hxxps://akamaitechcloudservices[.]com/v2/storage d51a790d187439ce030cf763237e992e9196e9aa41797a |
| domain | azuredeploystore.com | 1720d77c47b97d97c3b0cf43ade5d96bf724639bd icon4.ico hxxps://azuredeploystore[.]com/cloud/services c13d49ed325dec9551906bafb6de9ec947e5ff936e |
| domain | azureonlinestorage.com | 237e992e9196e9aa41797a94956681b6279d1b9a icon12.ico hxxps://azureonlinestorage[.]com/azure/storage 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123 |
| domain | glcloudservice.com | 0242efd78fd4ed0c344ac6469611ec72defa6b2d icon14.ico hxxps://glcloudservice[.]com/v1/console f47c883f59a4802514c57680de3f41f690871e26f250c6 |
| domain | msedgepackageinfo.com | a0b4920933fbb9cf123cde33e1674fde6d61444f icon13.ico hxxps://msedgepackageinfo[.]com/microsoft-edge 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c34 |
| domain | msstorageazure.com | f4771e897fb5a617998aa4876e0e1baa5fbb8e25c icon1.ico hxxps://msstorageazure[.]com/window d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57 |
| domain | msstorageboxes.com | fb6de9ec947e5ff936e7e40877feb2ba4bb176396 icon5.ico hxxps://msstorageboxes[.]com/office f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e046 |
| domain | officeaddons.com | 4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 icon6.ico hxxps://officeaddons[.]com/technologies 2487b4e3c950d56fb15316245b3c51fbd70717838f6f |
| domain | officestoragebox.com | 33a48e228c32bcf26bd98e51310efd48e80c1789f icon2.ico hxxps://officestoragebox[.]com/api/session 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb50 |
| domain | pbxcloudeservices.com | 10ce22d71e05b20bad74d53fae158dc752a65782e icon9.ico hxxps://pbxcloudeservices[.]com/phonesystem Table 1. Icon files hosted at GitHub account |
| domain | pbxphonenetwork.com | acharryblogs[.]com/xmlquery pbxcloudeservices[.]com/network pbxphonenetwork[.]com/phone akamaitechcloudservices[.]com/v2/fileapi azureonlin |
| domain | pbxsources.com | de3f41f690871e26f250c6e890651ba71027e4d3 icon15.ico hxxps://pbxsources[.]com/exchange 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e513 |
| domain | sourceslabs.com | 45b3c51fbd70717838f6f82f32db2efcc4d9da6de icon7.ico hxxps://sourceslabs[.]com/downloads e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b368 |
| domain | visualstudiofactory.com | 0da72c57214ac987efbb509c46cc57ea6b214beca icon3.ico hxxps://visualstudiofactory[.]com/workload c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43a |
| domain | zacharryblogs.com | c2b6fe188d5f4359c308b3684b1e0db2071c3425c icon8.ico hxxps://zacharryblogs[.]com/feed d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158 |
| sha256 | 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 | 21ab420c443ab7b15ed42aed91fd31ce833896 Malicious ffmpeg.dll 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 Malicious d3dcompiler_47.dll c485674ee63ec8d4e8fde980078817 |
| sha256 | 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de | e6e6e3182 icon6.ico hxxps://officeaddons[.]com/technologies 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de icon7.ico hxxps://sourceslabs[.]com/downloads e059c8c8b01d6 |
| sha256 | 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca | c1789f icon2.ico hxxps://officestoragebox[.]com/api/session 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca icon3.ico hxxps://visualstudiofactory[.]com/workload c62dce |
| sha256 | 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f | 651ba71027e4d3 icon15.ico hxxps://pbxsources[.]com/exchange 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f icon2.ico hxxps://officestoragebox[.]com/api/session 268d4e |
| sha256 | 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f | a icon12.ico hxxps://azureonlinestorage[.]com/azure/storage 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f icon13.ico hxxps://msedgepackageinfo[.]com/microsoft-edge 8 |
| sha256 | 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 | f9be345823b4fdcf5d868 3CXDesktopApp-18.12.407.msi Installer 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 3CXDesktopApp-18.11.1213.dmg Installer e6bbc33815b9f20b0cf8 |
| sha256 | 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 | main protected. Indicators of Compromise SHA256 Description 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3CXDesktopApp-18.12.416.msi Installer aa124a4b4df12b34e74ee |
| sha256 | 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 | c6010a4297e321 3CXDesktopApp-18.12.416-full.nupkg Installer 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 Malicious ffmpeg.dll 11be1803e2e307b647a8a7e02d128335c448ff |
| sha256 | 7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321 | 28b5891336706da0dbcec 3CXDesktopApp-18.12.416.dmg Installer 7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321 3CXDesktopApp-18.12.416-full.nupkg Installer 7986bbaee8940d |
| sha256 | 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d | f icon13.ico hxxps://msedgepackageinfo[.]com/microsoft-edge 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d icon14.ico hxxps://glcloudservice[.]com/v1/console f47c883f |
| sha256 | a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c | from within the file. SHA256 Icon Filename C2 URL Extracted a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c icon1.ico hxxps://msstorageazure[.]com/window d459aa0a63140 |
| sha256 | a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 | 573e5d9973caa676f58086c99561382d7 Malicious libffmpeg.dylib a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 Malicious libffmpeg.dylib URL Description msstorageazure[.] |
| sha256 | aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 | 850ba46794d9c7a2c0983 3CXDesktopApp-18.12.416.msi Installer aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 3CXDesktopApp-18.12.407.msi Installer 5407cda7d3a75e7b1e030 |
| sha256 | aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973 | 88175a8b02d3f9416d0e763360fff7f8eb4e02 Malicious ffmpeg.dll aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973 Malicious DLL in d3dcompiler_47.dll fee4f9dabc094df24d83ec1 |
| sha256 | c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 | 9bd icon4.ico hxxps://azuredeploystore[.]com/cloud/services c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 icon5.ico hxxps://msstorageboxes[.]com/office f1bf4078141d7 |
| sha256 | c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 | 48ff741bf06bf52b332e0bbf423b03 Malicious d3dcompiler_47.dll c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 Malicious ffmpeg.dll aa4e398b3bd8645016d8090ffc77d15f926a8e |
| sha256 | c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd | 14beca icon3.ico hxxps://visualstudiofactory[.]com/workload c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd icon4.ico hxxps://azuredeploystore[.]com/cloud/services c13 |
| sha256 | d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e | b1e0db2071c3425c icon8.ico hxxps://zacharryblogs[.]com/feed d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e icon9.ico hxxps://pbxcloudeservices[.]com/phonesystem Table |
| sha256 | d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 | 1baa5fbb8e25c icon1.ico hxxps://msstorageazure[.]com/window d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 icon10.ico and icon11.ico hxxps://akamaitechcloudservices[. |
| sha256 | d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a | icon11.ico hxxps://akamaitechcloudservices[.]com/v2/storage d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a icon12.ico hxxps://azureonlinestorage[.]com/azure/storage 4 |
| sha256 | e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c | 2efcc4d9da6de icon7.ico hxxps://sourceslabs[.]com/downloads e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c icon8.ico hxxps://zacharryblogs[.]com/feed d0f1984b4fe896d0 |
| sha256 | e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec | 3ae19c671051ed314290 3CXDesktopApp-18.11.1213.dmg Installer e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 3CXDesktopApp-18.12.416.dmg Installer 7c55c3dfa373b6b342390 |
| sha256 | f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 | b2ba4bb176396 icon5.ico hxxps://msstorageboxes[.]com/office f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 icon6.ico hxxps://officeaddons[.]com/technologies 2487b4e3c |
| sha256 | f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 | defa6b2d icon14.ico hxxps://glcloudservice[.]com/v1/console f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 icon15.ico hxxps://pbxsources[.]com/exchange 2c9957ea04d033 |
| sha256 | fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 | 58642191deb4e68688ff973 Malicious DLL in d3dcompiler_47.dll fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 Malicious libffmpeg.dylib a64fa9f1c76457ecc58402142a8728ce3 |
| url | https://akamaitechcloudservices.com/v2/storage | d4c310c262a88896c57bbe3b6456bd090 icon10.ico and icon11.ico hxxps://akamaitechcloudservices[.]com/v2/storage d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b62 |
| url | https://azuredeploystore.com/cloud/services | 74e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd icon4.ico hxxps://azuredeploystore[.]com/cloud/services c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4b |
| url | https://azureonlinestorage.com/azure/storage | 030cf763237e992e9196e9aa41797a94956681b6279d1b9a icon12.ico hxxps://azureonlinestorage[.]com/azure/storage 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6 |
| url | https://glcloudservice.com/v1/console | f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d icon14.ico hxxps://glcloudservice[.]com/v1/console f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71 |
| url | https://msedgepackageinfo.com/microsoft-edge | de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f icon13.ico hxxps://msedgepackageinfo[.]com/microsoft-edge 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72d |
| url | https://msstorageazure.com/window | e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c icon1.ico hxxps://msstorageazure[.]com/window d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b64 |
| url | https://msstorageboxes.com/office | 551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 icon5.ico hxxps://msstorageboxes[.]com/office f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6 |
| url | https://officeaddons.com/technologies | b4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 icon6.ico hxxps://officeaddons[.]com/technologies 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4 |
| url | https://officestoragebox.com/api/session | 68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f icon2.ico hxxps://officestoragebox[.]com/api/session 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b |
| url | https://pbxcloudeservices.com/phonesystem | 0024533510ce22d71e05b20bad74d53fae158dc752a65782e icon9.ico hxxps://pbxcloudeservices[.]com/phonesystem Table 1. Icon files hosted at GitHub account used by payl |
| url | https://pbxsources.com/exchange | 14c57680de3f41f690871e26f250c6e890651ba71027e4d3 icon15.ico hxxps://pbxsources[.]com/exchange 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e8 |
| url | https://raw.githubusercontent.com/IconStorages/images/main/icon[1-15 | name includes a randomly generated number between 1 and 15: hxxps://raw.githubusercontent[.]com/IconStorages/images/main/icon[1-15].ico This request looks similar to the one below. GET /Ic |
| url | https://sourceslabs.com/downloads | fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de icon7.ico hxxps://sourceslabs[.]com/downloads e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db207 |
| url | https://visualstudiofactory.com/workload | ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca icon3.ico hxxps://visualstudiofactory[.]com/workload c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf7 |
| url | https://zacharryblogs.com/feed | af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c icon8.ico hxxps://zacharryblogs[.]com/feed d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752 |
From the original article
9 min read at unit42.paloaltonetworks.com
On March 29, 2023, there was a supply chain attack involving a software-based phone application called 3CXDesktopApp . As of March 30, the 3CXDesktopApp installer hosted on the developer’s website will install the application with two malicious libraries included.
By Robert Falcone, Josh Grunzweig · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.