3CX supply chain attack
Write-up

A supply chain attack is a type of cyber attack that targets the software, hardware, or services provided by a third-party vendor or supplier to gain unauthorized access to an organization's systems or data. As we have seen before with for instance the SolarWinds^[2] attack in 2020. In this type of attack, the attacker exploits vulnerabilities or weaknesses in the supply chain to gain access to an organization's network or sensitive information.

For example, an attacker may compromise a software vendor's update server and distribute malware to the vendor's customers, including the targeted organization. The malware would then be able to execute on the targeted organization's systems, giving the attacker access to sensitive data or control over the systems.

Supply chain attacks are becoming increasingly common and can be difficult to detect (and therefor go unnoticed for a long time) and mitigate, as they often target trusted vendors and use legitimate channels to deliver malware or other malicious payloads. Organizations can reduce their risk of supply chain attacks by implementing security measures such as vendor risk management, vulnerability management, and threat intelligence gathering.

For those who do not have Managed Detection & Response provided by Hunt & Hackett there are different things you can do to determine whether you might have been impacted.

 

Prevention – make sure that the malicious update cannot be downloaded/ distributed internally

It could be the case that your organization has not downloaded the malicious version of 3CX yet. Before you continue with the next steps and in order to avoid that other systems continue to download the malicious version you want to check whether this is true for your 3CX server and also inform your users to not download the software from the website. Therefore, if applicable remove the affected update from 3CX Server, wait until a confirmed clean version is available and use the PWA app^[3] as recommended by 3CX in the meantime:

• 12.407 (Windows);
• 12.416 (Windows);
• 11.1213 (MacOS).
  
  

Detection – Verify presence of vulnerable software in your infrastructure

First, check if specific files are available on the system, which are known malicious binaries of 3CX, as also outlined Table 1. Hunt & Hackett created queries for both Windows and MacOS to check for the presence of the application. If the application is found on one or more of your systems, it’s important to find out which version of the application is running. If it is one of the below mentioned version, we advise to quarantine the asset and start an investigation into possible compromise of the asset and lateral movement of the adversary:

• 12.407 (Windows);
• 12.416 (Windows);
• 11.1213 (MacOS).
  
  

Windows

 

MacOS

 

Second, check whether systems have been beaconing to the known Command & Control domain names. You can do this by verifying in i.e. your firewall logging, whether the domains have been contacted by systems in your infrastructure. If there are hits, we recommend you to zoom in on these systems and check for the presence of 3CX software as well as the known malicious binaries/ versions of the software. You can do this by performing the earlier mentioned steps. If it is one of the known malicious versions, we advise to quarantine the asset and start an investigation into possible compromise of the asset and lateral movement.

 

Response – if you have hits on the indicators of compromise

When traces are observed of the known malicious binaries, or systems beaconing to the command of controller servers, it is important to verify whether abnormal activity has taken place on the system. Therefore we would like to recommend you to look into potential lateral movement. In order to do so, you can search for anomalous connections and logins from, on or to oter systems from the impacted machine. If you do not feel comfortable by performing this step yourself, please feel free to reach out to Hunt & Hackett (cert@huntandhackett.com, or +31702220000), or your preferred IR partner.

 

Mitigation/ remediation – in case you have been impacted

After concluding that you have been impacted, but no lateral movement has taken place, or any other adversary activity, we would like to recommend the following:

• Since the malicious version of 3CX contains info stealing functionality it important for the affected systems to:
  • Reset credentials, especially credentials that are stored in a browser
  • Revoke session(s) (cookies)
• Roll out a new installation of the OS on the affected machines, so that staff can continue to work safely on the systems. If this is not possible, due to time constrains, or any other important reason, please clean the systems by removing all of the malicious files from the update location and wait for a confirmed clean version of 3CX.