3CX Breach Was a Double Supply Chain Compromise
Summary: Mandiant reported that the 3CX desktop application compromise began in 2022 when a 3CX employee installed a malware-laced package distributed through an earlier supply chain compromise that started with a tampered installer for Trading Technologies' X_TRADER software. Mandiant, which attributed the intrusion to the North Korean state-sponsored group Lazarus, said this was the first time it had seen one software supply chain attack lead to another, and the compromised 3CX builds for Windows and macOS pushed malware that retrieved instructions from encrypted icon files on GitHub and ultimately delivered a password stealer called ICONICSTEALER.
What's compelling: 3CX reports more than 600,000 customers and 12 million users, and Mandiant said it expects many more victims to be discovered among customers of both Trading Technologies and 3CX now that the compromised software is public.
Read the original at Krebs on Security ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026