3CX Backdoor (Windows)Malware
- SUDDENICON
According to CrowdStrike, this backdoor was discovered being embedded in a legitimate, signed version of 3CXDesktopApp, and thus constitutes a supply chain attack.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1055Process Injection
“Irrespective of the anti-malware technology you are using, shellcode and process injection alerts for 3CX should not be added to exception lists”
- T1195Supply Chain Compromise
“On March 29, 2023, CrowdStrike reported a potential supply-chain compromise affecting 3CX VOIP softphone users as detailed in a Reddit post.”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic users protected from SUDDENICON’s supply chain attack“Elastic users protected from SUDDENICON’s supply chain attack”
Indicators in its reports
named in the reports above- hxxps://www.reddit[.]com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/in 1 report
- hxxps://www.todyl[.]com/blog/post/threat-advisory-3cx-softphone-telephony-campaignin 1 report
- www.todyl[.]comin 1 report
- 7986bbaee8940da1…fd31ce833896in 1 report
- c485674ee63ec8d4…fff7f8eb4e02in 1 report
- akamaicontainer[.]comin 1 report
- akamaitechcloudservices[.]comin 1 report
- azuredeploystore[.]comin 1 report
- azureonlinecloud[.]comin 1 report
- azureonlinestorage[.]comin 1 report
- dunamistrd[.]comin 1 report
- glcloudservice[.]comin 1 report
- journalide[.]orgin 1 report
- msedgepackageinfo[.]comin 1 report
- msstorageazure[.]comin 1 report
- msstorageboxes[.]comin 1 report
- officeaddons[.]comin 1 report
- officestoragebox[.]comin 1 report
- pbxcloudeservices[.]comin 1 report
- pbxphonenetwork[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.