3CXDesktopApp
live blog contains information regarding the 3CXDesktopApp vulnerability. As soon as we have an update, we’ll add it to this post. More information about possible risks and details can be found at the bottom of this blog. Last updated on April 3, 2023.
T-Update
Update 3 April 2023
18:00 | We updated our blog about the 3CXDesktopApp incident with the latest information. On the 1st of April 2023 3CX has published an update on the current situation and recommended actions for those organizations using 3CXDesktopApp.
At this moment it is recommended to uninstall the 3CX Electron Desktop Application from systems running Windows or MacOS. Instead, it is possible to use the PWA Web Client App, or the legacy Desktop Application if mandatory functionality is missing. Furthermore, it is recommended to continue monitoring your environment with up-to-date AV and/or EDR solutions for potential malware.
Based on the latest information, the following versions of the 3CX Electron Desktop Application are affected:
- Windows
- 18.12.407
- 18.12.416
- MacOS
- 18.11.1213 shipped with Update 6
- 18.12.402
- 18.12.407
- 18.12.416 in Update 7
Update 30 March 2023
14:00 | This is an ongoing and evolving incident. More information might be added to this liveblog at a later stage.
The Voice over IP (VoIP) desktop client 3CXDesktopApp, version numbers 18.12.407 and 18.12.416, likely contains a library which has been altered by a threat actor to perform supply chain attacks.
When the 3CXDesktopApp is used in your environment, it can be used to download malicious payloads to the system it is installed on. Currently, these payloads appear to be information stealing malware. At this moment only the 3CXDesktopApp for the Microsoft Windows OS has been determined to contain the malicious code. Research is on-going whether 3CX browser extensions and the MacOS, iOS, or Android applications contain similar malicious code.
Background
The Voice over IP (VoIP) desktop client 3CXDesktopApp, version numbers 18.12.407 and 18.12.416, likely contains a library which has been altered by a threat actor to perform supply chain attacks. When the 3CXDesktopApp is used in your environment, it can be used to download malicious payloads to the system it is installed on. Currently, these payloads appear to be information stealing malware. At this moment only the 3CXDesktopApp for the Microsoft Windows OS has been determined to contain the malicious code. Research is on-going whether 3CX browser extensions and the MacOS, iOS, or Android applications contain similar malicious code.
Risk
The current payloads have been identified as information stealing malware. This type of malware may extract sensitive information from a system, including, but not limited to, credentials and browser bookmarks. While additional threats have not yet been seen, due to the nature of the risk, the threat actor may change their tactics and malware at any given time.
Advice
Sources
More information is available at:
- 3CX, https://www.3cx.com/blog/news/desktopapp-security-alert/
- 3CX, https://www.3cx.com/blog/news/security-incident-updates/
- Dutch NCSC advisory, https://www.ncsc.nl/actueel/nieuws/2023/maart/30/ncsc-waarschuwt-voor-supplychain-aanval-3cx
- SentinelOne, https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
- Crowdstrike, https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
Sign up to receive T-Updates
Receive the latest vulnerabilities in your email every Wednesday
More than 1,000 organisations have already joined us.
