36gate: supply chain attack
Contents
What is known so far?
On the 29th of March, 2023 SentinelOne, Crowdstrike, and IBM Sophos reported malicious activity of a trojanized version of the 3CX Desktop App, a client used to make VoIP calls.
One day later, on March 30th, it was found that the malicious application was not specially crafted, but was in fact legitimate software published and signed by a certificate belonging to 3CX, a phone system software provider, whose customers include Wilson, Mercedes-Benz, Coca Cola, and many other large enterprises, according to the company’s website. The full consequences of this supply chain incident are yet to be seen.
That same day, the company’s CEO issued an advisory and recommended using 3CX’s PAW client until a new build is released:
As part of the attack, the malicious installer deploys legitimate software with malicious libraries. Once the application is launched, a malicious code sleeps and then attempts to download and execute a …
On the 29th of March, 2023 SentinelOne, Crowdstrike, and IBM Sophos reported malicious activity of a trojanized version of the 3CX Desktop App, a client used to make VoIP calls.
One day later, on March 30th, it was found that the malicious application was not specially crafted, but was in fact legitimate software published and signed by a certificate belonging to 3CX, a phone system software provider, whose customers include Wilson, Mercedes-Benz, Coca Cola, and many other large enterprises, according to the company’s website. The full consequences of this supply chain incident are yet to be seen.
That same day, the company’s CEO issued an advisory and recommended using 3CX’s PAW client until a new build is released:
As part of the attack, the malicious installer deploys legitimate software with malicious libraries. Once the application is launched, a malicious code sleeps and then attempts to download and execute a …
IoC
0d890267ec8d6d2aaf43eaca727c1fbba6acd16e
0eeb1c0133eb4d571178b2d9d14ce3e9
11ae67704ea0b930b2cc966e6d07f8b898f1a7d2
11bc82a9bd8297bd0823bce5d6202082
11bd685041d98d392df3d95f96d96dc1
11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
188754814b37927badc988b45b7c7f7d6b4c8dd3
19f4036f5cd91c5fc411afc4359e32f90caddaac
20d554a80d759c50d6537dd7097fed84dd258b3e
253f3a53796f1b0fbe64f7b05ae1d66bc2b0773588d00c3d2bf08572a497fa59
27b134af30f4a86f177db2f2555fe01d
2fdf61fdfd649f8bbf5730307a0ab5d1
31d775ab577f3cc88991d90e9ae58501dbe1f0da
3703770e32820397c6e7e1e1221e6d0d
3992dbe9e0b23e0d4ca487faffeb004bcfe9ecc8
3b3e778b647371262120a523eb873c20bb82beaf
3b88cda62cdd918b62ef5aa8c5a73a46f176d18b
3dc840d32ce86cebf657b17cef62814646ba8e98
5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290
5729fb29e3a7a90d2528e3357bd15a4b
57a9f3d5d1592a0769886493f566930d8f32a0fc
59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
5d833bcc679db38a45111269e727ec58b75c8d31
6285ffb5f98d35cd98e78d48b63a05af6e4e4dea
6426fe4dc604c7f1784ed1d48ab4ffc8
64ab912d0af35c01355430d85dd4181f25e88838
660ea9b8205fbd2da59fefd26ae5115c
74bc2d0b6680faa1a5a76b27e5479cbc
769383fc65d1386dd141c960c9970114547da0c2
7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896
7a1d41c8e9e4bd19e0e360ec17e30c38e4f9ca0d
7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321
7faea2b01796b80d180399040bb69835
82187ad3f0c6c225e2fba0c867280cc9
82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807
8377fb40c76aa3ba3efae3d284fa51aa7748e010
83cba55f180b0c100935137615e8d296
8433a94aedb6380ac8d4610af643fb0e5220c5cb
894e7d4ffd764bb458809c7f0643694b036ead30
89827af650640c7042077be64dc643230d1f7482
8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423
92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61
96910a3dbc194a7bf9a452afe8a35eceb904b6e4
9833a4779b69b38e3e51f04e395674c6
a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67
aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868
aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973
b1dee3ebcffad01a51ff31ff495fef1d40fdfaa0
b2a89eebb5be61939f5458a024c929b169b4dc85
b5de30a83084d6f27d902b96dd12e15c77d1f90b
b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb
bb915073385dd16a846dfa318afa3c19
bea77d1e59cf18dce22ad9a2fad52948fd7a9efa
bf939c9c261d27ee7bb92325cc588624fca75429
bfecb8ce89a312d2ef4afc64a63847ae11c6f69e
c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02
ca8c0385ce2b8bdd19423c8b98a5924b
caa77bcd0a1a6629ba1f3ce8d1fc5451d83d0352
cad1120d91b812acafef7175f949dd1b09c6c21a
cb01ff4809638410a531400a66376fa3
d5101c3b86d973a848ab7ed79cd11e5a
dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc
e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec
f3487a1324f4c11b35504751a5527bc60eb95382
f3d4144860ca10ba60f7ef4d176cc736
f533bea1c0558f73f6a3930343c16945fb75b20f
f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952
f7f1b34c2770d83e2250e19c8425a4bec56617fd
fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405
fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7
ff3dd457c0d00d00d396fdf6ebe7c254fed2a91e
ffccc3a29d1582989430e9b6c6d2bff1e3a3bb14
http://akamaicontainer.com
http://akamaitechcloudservices.com
http://akamaitechcloudservices.com/v2/fileapi
http://akamaitechcloudservices.com/v2/storage
http://azuredeploystore.com
http://azuredeploystore.com/cloud/images
http://azuredeploystore.com/cloud/services
http://azureonlinecloud.com
http://azureonlinestorage.com
http://azureonlinestorage.com/azure/storage
http://azureonlinestorage.com/google/storage
http://dunamistrd.com
http://glcloudservice.com
http://glcloudservice.com/v1/console
http://glcloudservice.com/v1/status
http://msedgepackageinfo.com
http://msedgepackageinfo.com/microsoft-edge
http://msedgepackageinfo.com/ms-webview
http://msstorageazure.com
http://msstorageazure.com/analysis
http://msstorageazure.com/window
http://msstorageboxes.com
http://msstorageboxes.com/office
http://msstorageboxes.com/xbox
http://officeaddons.com
http://officeaddons.com/quality
http://officeaddons.com/technologies
http://officestoragebox.com
http://officestoragebox.com/api/biosync
http://officestoragebox.com/api/session
http://pbxcloudeservices.com
http://pbxcloudeservices.com/network
http://pbxcloudeservices.com/phonesystem
http://pbxphonenetwork.com
http://pbxphonenetwork.com/phone
http://pbxsources.com
http://pbxsources.com/exchange
http://pbxsources.com/queue
http://qwepoi123098.com
http://sbmsa.wiki/blog/_insert
http://sourceslabs.com
http://sourceslabs.com/downloads
http://sourceslabs.com/status
http://visualstudiofactory.com
http://visualstudiofactory.com/groupcore
http://visualstudiofactory.com/workload
http://www.journalide.org
http://zacharryblogs.com
http://zacharryblogs.com/feed
http://zacharryblogs.com/xmlquery
https://akamaitechcloudservices.com/v2/storage
https://azuredeploystore.com/cloud/services
https://azureonlinestorage.com/azure/storage
https://glcloudservice.com/v1/console
https://msedgepackageinfo.com/microsoft-edge
https://msstorageazure.com/window
https://msstorageboxes.com/office
https://officeaddons.com/technologies
https://officestoragebox.com/api/session
https://pbxcloudeservices.com/phonesystem
https://pbxsources.com/exchange
https://raw.githubusercontent.com/IconStorages/images/main/icon[1;15].ico
https://sourceslabs.com/downloads
https://visualstudiofactory.com/workload
https://zacharryblogs.com/feed
0eeb1c0133eb4d571178b2d9d14ce3e9
11ae67704ea0b930b2cc966e6d07f8b898f1a7d2
11bc82a9bd8297bd0823bce5d6202082
11bd685041d98d392df3d95f96d96dc1
11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
188754814b37927badc988b45b7c7f7d6b4c8dd3
19f4036f5cd91c5fc411afc4359e32f90caddaac
20d554a80d759c50d6537dd7097fed84dd258b3e
253f3a53796f1b0fbe64f7b05ae1d66bc2b0773588d00c3d2bf08572a497fa59
27b134af30f4a86f177db2f2555fe01d
2fdf61fdfd649f8bbf5730307a0ab5d1
31d775ab577f3cc88991d90e9ae58501dbe1f0da
3703770e32820397c6e7e1e1221e6d0d
3992dbe9e0b23e0d4ca487faffeb004bcfe9ecc8
3b3e778b647371262120a523eb873c20bb82beaf
3b88cda62cdd918b62ef5aa8c5a73a46f176d18b
3dc840d32ce86cebf657b17cef62814646ba8e98
5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290
5729fb29e3a7a90d2528e3357bd15a4b
57a9f3d5d1592a0769886493f566930d8f32a0fc
59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
5d833bcc679db38a45111269e727ec58b75c8d31
6285ffb5f98d35cd98e78d48b63a05af6e4e4dea
6426fe4dc604c7f1784ed1d48ab4ffc8
64ab912d0af35c01355430d85dd4181f25e88838
660ea9b8205fbd2da59fefd26ae5115c
74bc2d0b6680faa1a5a76b27e5479cbc
769383fc65d1386dd141c960c9970114547da0c2
7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896
7a1d41c8e9e4bd19e0e360ec17e30c38e4f9ca0d
7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321
7faea2b01796b80d180399040bb69835
82187ad3f0c6c225e2fba0c867280cc9
82a2dafd6ce594f2cf8588f32585c71be2180fc4cf9a144e300b1692f3de5807
8377fb40c76aa3ba3efae3d284fa51aa7748e010
83cba55f180b0c100935137615e8d296
8433a94aedb6380ac8d4610af643fb0e5220c5cb
894e7d4ffd764bb458809c7f0643694b036ead30
89827af650640c7042077be64dc643230d1f7482
8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423
92005051ae314d61074ed94a52e76b1c3e21e7f0e8c1d1fdd497a006ce45fa61
96910a3dbc194a7bf9a452afe8a35eceb904b6e4
9833a4779b69b38e3e51f04e395674c6
a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67
aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868
aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973
b1dee3ebcffad01a51ff31ff495fef1d40fdfaa0
b2a89eebb5be61939f5458a024c929b169b4dc85
b5de30a83084d6f27d902b96dd12e15c77d1f90b
b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb
bb915073385dd16a846dfa318afa3c19
bea77d1e59cf18dce22ad9a2fad52948fd7a9efa
bf939c9c261d27ee7bb92325cc588624fca75429
bfecb8ce89a312d2ef4afc64a63847ae11c6f69e
c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02
ca8c0385ce2b8bdd19423c8b98a5924b
caa77bcd0a1a6629ba1f3ce8d1fc5451d83d0352
cad1120d91b812acafef7175f949dd1b09c6c21a
cb01ff4809638410a531400a66376fa3
d5101c3b86d973a848ab7ed79cd11e5a
dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc
e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec
f3487a1324f4c11b35504751a5527bc60eb95382
f3d4144860ca10ba60f7ef4d176cc736
f533bea1c0558f73f6a3930343c16945fb75b20f
f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952
f7f1b34c2770d83e2250e19c8425a4bec56617fd
fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405
fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7
ff3dd457c0d00d00d396fdf6ebe7c254fed2a91e
ffccc3a29d1582989430e9b6c6d2bff1e3a3bb14
http://akamaicontainer.com
http://akamaitechcloudservices.com
http://akamaitechcloudservices.com/v2/fileapi
http://akamaitechcloudservices.com/v2/storage
http://azuredeploystore.com
http://azuredeploystore.com/cloud/images
http://azuredeploystore.com/cloud/services
http://azureonlinecloud.com
http://azureonlinestorage.com
http://azureonlinestorage.com/azure/storage
http://azureonlinestorage.com/google/storage
http://dunamistrd.com
http://glcloudservice.com
http://glcloudservice.com/v1/console
http://glcloudservice.com/v1/status
http://msedgepackageinfo.com
http://msedgepackageinfo.com/microsoft-edge
http://msedgepackageinfo.com/ms-webview
http://msstorageazure.com
http://msstorageazure.com/analysis
http://msstorageazure.com/window
http://msstorageboxes.com
http://msstorageboxes.com/office
http://msstorageboxes.com/xbox
http://officeaddons.com
http://officeaddons.com/quality
http://officeaddons.com/technologies
http://officestoragebox.com
http://officestoragebox.com/api/biosync
http://officestoragebox.com/api/session
http://pbxcloudeservices.com
http://pbxcloudeservices.com/network
http://pbxcloudeservices.com/phonesystem
http://pbxphonenetwork.com
http://pbxphonenetwork.com/phone
http://pbxsources.com
http://pbxsources.com/exchange
http://pbxsources.com/queue
http://qwepoi123098.com
http://sbmsa.wiki/blog/_insert
http://sourceslabs.com
http://sourceslabs.com/downloads
http://sourceslabs.com/status
http://visualstudiofactory.com
http://visualstudiofactory.com/groupcore
http://visualstudiofactory.com/workload
http://www.journalide.org
http://zacharryblogs.com
http://zacharryblogs.com/feed
http://zacharryblogs.com/xmlquery
https://akamaitechcloudservices.com/v2/storage
https://azuredeploystore.com/cloud/services
https://azureonlinestorage.com/azure/storage
https://glcloudservice.com/v1/console
https://msedgepackageinfo.com/microsoft-edge
https://msstorageazure.com/window
https://msstorageboxes.com/office
https://officeaddons.com/technologies
https://officestoragebox.com/api/session
https://pbxcloudeservices.com/phonesystem
https://pbxsources.com/exchange
https://raw.githubusercontent.com/IconStorages/images/main/icon[1;15].ico
https://sourceslabs.com/downloads
https://visualstudiofactory.com/workload
https://zacharryblogs.com/feed