3CX.pdf (11 MB)

CrowdStrike and SentinelOne observed a 3CXDesktopApp software supply-chain compromise in which an actor believed to be affiliated with Lazarus inserted malicious code into official Windows and macOS builds. On Windows, the signed 3CX MSI installed 3CXDesktopApp.exe, which side-loaded a backdoored ffmpeg.dll and loaded d3dcompiler_47.dll containing an RC4-encrypted second-stage payload. The second stage downloaded an icon file from GitHub, decrypted data appended to it, and recovered the C2 URL https[:]//glcloudservice[.]com/v1/console for HTTPS communications. The final payload is described as an infostealer capable of collecting system information and browser data such as saved credentials from browsers including Brave and Chrome, making the compromise high-impact because trusted update infrastructure exposed many downstream users.