Anatomy of a Breach

Anatomy of a Breach: 3CX — A Supply Chain Attack Born from Another Supply Chain Attack

> series: anatomy_of_a_breach —— part: 171 —— target: 3cx —— attacker: lazarus_group —— method: supply_chain_from_supply_chain<span class="cursor-blink">_</span>_

Hedgehog Security 31 March 2023 13 min read

A supply chain attack. Caused by another supply chain attack. Supply chains all the way down.

In late March 2023, security firms detected that the 3CX desktop application — a VoIP platform used by over 600,000 organisations globally including American Express, McDonald's, and the NHS — was distributing malware through its legitimate update channel. The compromised build had been signed with 3CX's valid digital certificate, making it appear completely legitimate. The attack was attributed to North Korea's Lazarus Group.

The investigation revealed something unprecedented: the 3CX compromise had itself originated from an earlier supply chain attack. A 3CX employee had installed a trojanised version of X_Trader — a financial trading application from Trading Technologies — which had been compromised in a separate supply chain attack. The malware from the compromised trading software gave the attackers access to 3CX's build environment, which they used to poison 3CX's desktop application updates. It was the first documented case of a supply chain attack directly causing another supply chain attack — a cascading chain of compromises that demonstrated the exponential risk of software supply chain vulnerabilities.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

When your vendor's vendor's software is the attack vector.

Supply Chain → Supply Chain
The 3CX attack was born from the Trading Technologies compromise — a cascading supply chain attack. The implication: securing your own supply chain is insufficient if your vendors' supply chains are compromised. The depth of supply chain risk is effectively unlimited. <a href="/cyber-essentials">Cyber Essentials</a> addresses supply chain security, but the 3CX case demonstrated that supply chain risk extends beyond direct vendors.
Legitimately Signed Malware
The compromised 3CX update was signed with 3CX's valid digital certificate — making it indistinguishable from a legitimate update to traditional security tools. This is the same technique used in <a href="/blog/anatomy-of-a-breach-2020-year-review">SolarWinds/Sunburst</a> (2020). <a href="https://www.socinabox.co.uk">SOC in a Box</a> employs behavioural monitoring that detects malicious activity regardless of the legitimacy of the delivery mechanism.
Lazarus Group — Supply Chain Specialists
The Lazarus Group has now conducted supply chain attacks (<a href="/blog/anatomy-of-a-breach-ronin-axie">Ronin/Axie</a> 2022, 3CX 2023), bank heists (<a href="/blog/anatomy-of-a-breach-bangladesh-bank-swift">Bangladesh Bank</a> 2016), destructive attacks (<a href="/blog/anatomy-of-a-breach-sony-pictures">Sony Pictures</a> 2014), and ransomware (<a href="/blog/anatomy-of-a-breach-wannacry">WannaCry</a> 2017) — demonstrating the broadest operational capability of any state-sponsored group. <a href="https://www.cyber-defence.io/services/threat-intelligence">UK Cyber Defence</a> tracks Lazarus Group operations.
VoIP as Critical Infrastructure
3CX is used by over 600,000 organisations for voice communications — including healthcare providers. Compromising a VoIP platform enables both espionage (intercepting communications) and lateral movement into customer networks. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses VoIP security and communications platform hardening.

Supply chain risk is recursive. Your vendor's vendor is your attack surface.

The 3CX attack demonstrated that supply chain security cannot be addressed by evaluating only direct vendors — the entire chain of dependencies must be considered. For UK organisations, Cyber Essentials addresses direct supply chain security. Our infrastructure testing evaluates software update mechanisms and vendor trust relationships. SOC in a Box provides behavioural monitoring that detects malicious activity from legitimate-appearing software. And UK Cyber Defence's threat intelligence provides early warning of supply chain campaigns targeting specific platforms.


3CX was compromised through a compromised vendor. How deep does your supply chain risk go?

<a href="/penetration-testing/infrastructure">Infrastructure testing</a> assesses vendor trust. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects behavioural anomalies. <a href="https://www.cyber-defence.io/services/threat-intelligence">UK Cyber Defence</a> provides supply chain intelligence.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles