The 3CX Attack: A Supply-Chain Compromise Inside a Supply-Chain Compromise

In late March 2023, attackers trojanized 3CXDesktopApp, the Electron-based softphone client from VoIP vendor 3CX. The tampered builds were signed with 3CX’s own valid code-signing certificate and pushed through its legitimate update mechanism, so they reached customers as a trusted vendor update — a campaign security vendors labelled SmoothOperator. What made it historic was Mandiant’s later finding: 3CX had itself first been compromised via an earlier trojanized software supply chain, the discontinued X_TRADER app — the first publicly documented case of one software-supply-chain attack leading to another.

The Trojanized Update

The tampered 3CX builds (Windows versions reported as 18.12.407 and 18.12.416, with affected macOS builds) ran a loader (Mandiant’s SUDDENICON, also reported as ICONIC) that used DLL side-loading and a GitHub dead-drop resolver: it pulled encoded data appended to icon (.ico) files from a since-removed GitHub repository to decode C2 addresses, beacon out, and fetch a later-stage browser info-stealer (ICONICSTEALER). There is no central CVE — this was a build-system compromise and malicious update, not exploitation of a tracked vulnerability. T1195.002 T1102 T1553

The Cascade

Timeline & Attribution

A trojanized X_TRADER was available in 2022; trojanized 3CX builds were distributed around March 2023; SentinelOne saw a behavioural-detection spike on 22 March and public disclosure followed on 29 March 2023 (CrowdStrike, SentinelOne, Sophos and others), with Mandiant’s X_TRADER findings around 20 April. Mandiant attributes the activity to UNC4736, a suspected North Korea-nexus cluster it assesses with moderate confidence as related to financially motivated DPRK “AppleJeus” activity, with consistent crypto and fintech targeting. Treat attribution as a vendor assessment. T1059 T1071

Defensive Lessons

• Code signing is necessary but not sufficient — a signed binary from a trusted vendor can still be malicious; verify behaviour, not just signatures.
• Monitor trusted, approved apps for anomalous egress and beaconing, including to legitimate web services (such as GitHub) used as dead-drop resolvers.
• Prioritise behavioural/EDR detection of DLL side-loading and unexpected child processes over publisher allow-listing; maintain SBOMs to scope blast radius fast.
• Strengthen vendor and build-environment risk management at your own and your suppliers’ ends, and restrict installation of unmanaged or retired software (the X_TRADER initial-access lesson).