At the time of writing, the compromised binary of 3CXDesktopApp is being actively abused.Īs the campaign uses signed binary of the 3CXDesktopApp which is widely used, the risk of potential compromise of endpoints is High. This can lead to full compromise of the IT Infrastructure. Usage of the compromised software give the adversary full access to the accounts and data on the system where the update is installed. We assess the impact of this campaign as High since the campaign involves deployment of an 'infostealer' through the 3CX software. According to the sources, the final stage appears to be an info-stealer malware which is downloaded on the affected endpoint. This threat actor controlled infrastructure is then used to deliver the payloads for the subsequent stages. The malicious activity observed includes connecting to an infrastructure controlled by a threat actor. Based on the information available at the time of writing, the compromised binary is the first stage of a multi-stage attack chain. We advise to uninstall the 3CXDesktopApp software completely from the endpoints until a newer version has been released by 3CX.ģCX Desktop App is a softphone application from 3CX which is used for Voice over IP (VoIP) and telephony services. On Wednesday the 29th of March 2023, CrowdStrike reported malicious activity from a signed binary of the 3CXDesktopApp software. Threat Response: Multiple Critical Vulnerabilities in VMware.Threat Response: Zero-day vulnerabilities in Microsoft Exchange.
Threat Response Update: Zero-day vulnerabilities in Microsoft Exchange.Threat Response Update 2: Zero-day vulnerabilities in Microsoft Exchange.Threat Response: Critical vulnerability in OpenSSL 3.Threat Response: Vulnerability in Apache Commons Text library.Threat Response Update: Critical vulnerability in OpenSSL 3.Threat Response: Critical vulnerabilities in Citrix Gateway and Citrix ADC.Threat Response: Critical vulnerability in Fortinet SSL VPN.Threat Response: Critical vulnerability in Citrix Gateway and Citrix ADC.Threat Response Update 3: Zero-day vulnerabilities in Microsoft Exchange.Threat Response: Data Breach at LastPass.Threat Response Update: VMware Remote Code Execution Vulnerabilities.High risk vulnerability in Veeam Backup & Replication.Critical Vulnerability in Microsoft Outlook.Intrusion Campaign Using 3CXDesktopApp Software.
0 kommentar(er)
