Threat Brief: 3CXDesktop App Supply Chain Attack (Updated)
Summary: On March 29, 2023, a supply chain attack hit 3CXDesktopApp, with the installer hosted on the developer's website shipping two malicious libraries that ran shellcode to load a backdoor. Unit 42's Xpanse fingerprinting found 247,277 distinct IP addresses in 199 countries using 3CX applications, and between March 9-30, 2023, Cortex XDR observed 127 customers' systems where the 3CXDesktopApp process attempted to run shellcode, blocked by the In-process Shellcode Protection Module across 5,796 events on 1,832 unique systems.
Why it matters: A legitimate installer downloaded from the vendor's own site carried the backdoor, and the malware slept for a randomly chosen 1-4 weeks before acting, so a clean scan on install day tells you nothing. With 247,277 IPs in 199 countries running 3CX, the question is which of your endpoints ran the compromised versions and what they did during that quiet window.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026