3CX DesktopApp: signed Windows and macOS builds shipped with embedded malicious code after trojanized X_TRADER intrusion (CVE-2023-29059)
Severity: critical · Patch status: patched · Since 2023-03-29 · CVE-2023-29059
CrowdStrike reported on 2023-03-29 that the signed 3CXDesktopApp binary was beaconing to actor-controlled domains, downloading second-stage payloads and, in a small number of cases, giving hands-on keyboard activity, and tied the beacon structure to a LABYRINTH CHOLLIMA (DPRK-nexus) campaign from 2023-03-07. 3CX published a security alert for the Electron app on 2023-03-30. NVD lists the affected builds as Windows 18.12.407 and 18.12.416 and macOS 18.11.1213, 18.12.402, 18.12.407 and 18.12.416. Mandiant, engaged by 3CX, reported on 2023-04-20 that the intrusion began with a trojanized XTRADER installer from Trading Technologies, which led to a compromised 3CX build environment - the first case it had seen of one software supply chain compromise causing another. Mandiant tracks the actor as UNC4736 and assesses with moderate confidence a link to financially motivated North Korean AppleJeus activity, while noting weak infrastructure overlap with APT43 clusters.
What to do
- Inventory 3CX DesktopApp installs (Windows 18.12.407/18.12.416; macOS 18.11.1213-18.12.416) and remove or update affected builds per 3CX guidance.
- Hunt EDR/DNS logs for the beaconing domains CrowdStrike lists (e.g. akamaicontainer[.]com, azuredeploystore[.]com, pbxcloudeservices[.]com, sbmsa[.]wiki) and for the compromised ffmpeg.dll hash in CrowdStrike's post.
- Treat hosts that ran an affected build as potentially compromised: reset credentials used on them and review for second-stage tooling.
- Search for any installs of X_TRADER_r7.17.90p608.exe (Trading Technologies), the Mandiant-identified initial vector.
Sources
All live incidents on Threat Watch
