3CX Supply Chain Compromise Leads to ICONIC Incident
Summary: On March 29, 2023, Volexity reported that endpoints running the 3CX Desktop application received a malicious update signed by 3CX and downloaded from its own servers through the default automatic update process, installing information-stealing malware tracked as ICONIC. Volexity found malicious Windows and macOS installers on 3CX download servers, with a malicious ffmpeg.dll on Windows and libffmpeg.dylib on macOS, and noted public forum posts showing EDR and AV vendors flagged activity as early as March 22, 2023.
What's compelling: 3CX claims more than 600,000 customers and 12 million users, and the attacker appears to have had access to the software provider as early as December 2022, possibly November 2022 - months of dwell time inside the update pipeline before any payload shipped.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026