Group-IB analyzed the 3CXDesktopApp supply-chain compromise in which signed Windows and macOS builds were trojanized and distributed to customers of the VoIP software vendor. The Windows infection chain loads a modified ffmpeg.dll, reads encrypted shellcode from d3dcompiler_47.dll, and uses the RC4 key 3jB(2bsG#@c7 before launching a downloader. The downloader retrieves encoded C2 URLs hidden in GitHub-hosted .ico files, with representative infrastructure including msstorageazure[.]com/window, officestoragebox[.]com/api/session, visualstudiofactory[.]com/workload, and akamaitechcloudservices[.]com/v2/storage. Group-IB notes CrowdStrike reporting that matching beacon structure and encryption key material aligned with LABYRINTH CHOLLIMA/Lazarus activity, while the source’s practical emphasis is detection and incident response for organizations that installed affected 3CX versions.