In this blog, we will take a look at the affected valid signed 3CX MSI Installer version 18.12.416 named “3CXDesktopApp-18.12.416.msi” which is signed on March 13, 2023. This then downloads the valid signed Malicious 3CX MSI installer and the Affected 3CX MAC Application as required in the form of an update package on the victim’s machine as shown in the screenshot below.įig.3 – Requests to 3CX domain to download the Affected 3CX MSI installer v18.12.416 & 3CX Mac App v18.12.416 as an Update Package The Infection chain begins with the software update routine where the 3CXDesktopApp calls the “Update.exe –update ” from its bundle to fetch the updates. In this case the Threat Actors targeted various industry verticals such as:įurther let’s analyze the Infection Chain for the 3CX Supply Chain Attack: Fig.1 – Infections dating back to February 2023 in Zscaler Cloud
0 kommentar(er)
