UpdateAgentMalware
Last reported 3 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1055Process Injection
“Irrespective of the anti-malware technology you are using, shellcode and process injection alerts for 3CX should not be added to exception lists”
- T1195Supply Chain Compromise
“On March 29, 2023, CrowdStrike reported a potential supply-chain compromise affecting 3CX VOIP softphone users as detailed in a Reddit post.”
What the reports say
2 reports, newest first · the exact sentence from each-
Elastic users protected from SUDDENICON’s supply chain attack“…e.name : ("manifest")) or (host.os.type == "macos" and file.path : "*/Library/Application Support/3CX Desktop App/" and file.name : ("UpdateAgent", ".main_storage", ".session-lock")”
-
36gate: supply chain attack“On MacOS check for .session-lock , .main-storage and UpdateAgent files.”
Indicators in its reports
named in the reports above- 7986bbaee8940da1…fd31ce833896in 2 reports
- c485674ee63ec8d4…fff7f8eb4e02in 2 reports
- akamaicontainer[.]comin 2 reports
- akamaitechcloudservices[.]comin 2 reports
- azuredeploystore[.]comin 2 reports
- azureonlinecloud[.]comin 2 reports
- azureonlinestorage[.]comin 2 reports
- dunamistrd[.]comin 2 reports
- glcloudservice[.]comin 2 reports
- msedgepackageinfo[.]comin 2 reports
- msstorageazure[.]comin 2 reports
- msstorageboxes[.]comin 2 reports
- officeaddons[.]comin 2 reports
- officestoragebox[.]comin 2 reports
- pbxcloudeservices[.]comin 2 reports
- pbxphonenetwork[.]comin 2 reports
- pbxsources[.]comin 2 reports
- qwepoi123098[.]comin 2 reports
- sbmsa[.]wikiin 2 reports
- sourceslabs[.]comin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.