> series: anatomy_of_a_breach —— part: 171 —— target: 3cx —— attacker: lazarus_group —— method: supply_chain_from_supply_chain<span class="cursor-blink">_</span>_
In late March 2023, security firms detected that the 3CX desktop application — a VoIP platform used by over 600,000 organisations globally including American Express, McDonald's, and the NHS — was distributing malware through its legitimate update channel. The compromised build had been signed with 3CX's valid digital certificate, making it appear completely legitimate. The attack was attributed to North Korea's Lazarus Group.
The investigation revealed something unprecedented: the 3CX compromise had itself originated from an earlier supply chain attack. A 3CX employee had installed a trojanised version of X_Trader — a financial trading application from Trading Technologies — which had been compromised in a separate supply chain attack. The malware from the compromised trading software gave the attackers access to 3CX's build environment, which they used to poison 3CX's desktop application updates. It was the first documented case of a supply chain attack directly causing another supply chain attack — a cascading chain of compromises that demonstrated the exponential risk of software supply chain vulnerabilities.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe 3CX attack demonstrated that supply chain security cannot be addressed by evaluating only direct vendors — the entire chain of dependencies must be considered. For UK organisations, Cyber Essentials addresses direct supply chain security. Our infrastructure testing evaluates software update mechanisms and vendor trust relationships. SOC in a Box provides behavioural monitoring that detects malicious activity from legitimate-appearing software. And UK Cyber Defence's threat intelligence provides early warning of supply chain campaigns targeting specific platforms.
<a href="/penetration-testing/infrastructure">Infrastructure testing</a> assesses vendor trust. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects behavioural anomalies. <a href="https://www.cyber-defence.io/services/threat-intelligence">UK Cyber Defence</a> provides supply chain intelligence.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call