3CX Cybersecurity Event: Smooth Operator Strikes Again

Smooth Operator Strikes Again: Trojanizing 3CX Software in a Sneaky Software Supply Chain Attack

Heads up, folks! The Smooth Operator campaign is back in action, and this time it’s trojanizing 3CX software in an ongoing software supply chain attack. It’s a classic case of a wolf in sheep’s clothing, and we’re here to dissect the matter. In this article, we’ll explore the ins and outs of the 3CX cyber attack to keep you informed and on your toes. So, buckle up, and let’s dive in!

Executive Summary

3CX has issued a security alert regarding a malware issue affecting the 3CX Desktop App for Windows users. The company urges users to uninstall the compromised Electron client, which will be done automatically by Windows Defender, and reinstall it after a new update is released. In the meantime, 3CX recommends using the web-based PWA client, which offers most of the functionalities of the Desktop App without the risk of such issues. A full report on the matter will be published later, and 3CX apologizes for any inconvenience caused by this security concern.

SentinelOne Observations

On March 22, 2023, SentinelOne observed a surge in behavioral detections related to the 3CX Desktop App, a widely used voice and video conferencing software that functions as a Private Automatic Branch Exchange (PABX) platform. These behavioral detections effectively stopped the trojanized installers from executing, leading to immediate quarantine by default.

The compromised 3CX Desktop App serves as the initial phase in a multi-stage attack chain, which retrieves ICO files containing base64 data from GitHub and eventually results in a third-stage infostealer DLL still under analysis at the time of writing. Although SentinelOne and other leading cybersecurity organizations cannot confirm whether the Mac installer is also affected, their ongoing investigation extends to other applications, such as Chrome extensions, which could be exploited for similar attacks.

The compromised software includes a code signing certificate for the trojanized binaries. SentinelOne and other leading cybersecurity organizations are investigating the threat actor responsible for this supply chain attack. While the threat actor has established an extensive infrastructure since February 2022, no clear connections to known threat clusters have been identified.

As of March 30, 2023, SentinelOne has updated its Indicators of Compromise (IOCs) with contributions from the research community. This is an evolving situation, and we encourage you to check back for further updates.

Nick Galea, CEO of 3CX Response

Nick Galea, CEO of 3CX, has acknowledged the presence of malware in the 3CX Desktop App affecting Windows Electron clients running update 7. The issue was reported recently, and the company is working on an update to be released shortly. Users are advised to uninstall the app, which Windows Defender will do automatically, and then reinstall it. A full report on the issue will be released later.

In the meantime, Galea strongly recommends using the PWA client as it offers 99% of the Desktop App’s functionality, is web-based, and avoids such issues. The only limitations are the absence of hotkeys and BLF, which will be addressed soon. Users are encouraged to use the PWA client until a new build is released and consider using PWA over Electron. Galea and his team apologize for the inconvenience caused.

The Nitty-Gritty of the Smooth Operator Campaign

Trojanizing 3CX Software: What’s the Deal?

The Smooth Operator campaign has set its sights on 3CX software, a popular business communications solution. By trojanizing the software, the attackers infiltrate the supply chain, potentially affecting countless users. Look no further than this article for the skinny on this shady operation.

How Does It Work?

1. The attacker compromises a legitimate website hosting 3CX software.
2. They inject malicious code into the software package.
3. Unsuspecting users download the trojanized 3CX software.
4. The malware establishes a foothold, allowing the attacker to access the user’s system.

The Bigger Picture: Software Supply Chain Attacks

The Smooth Operator campaign is just the tip of the iceberg regarding software supply chain attacks. These types of cyberattacks are increasingly common and can wreak havoc on businesses and individual users. To stay ahead of the game, it’s crucial to understand the risks associated with software supply chain attacks and how to mitigate them.

Common Attack Vectors

• Compromised software updates
• Trojanized third-party components
• Malicious insiders
• Vulnerabilities in open-source software

Safeguarding Your Systems: Best Practices

Don’t let the Smooth Operator campaign catch you off guard. Follow these best practices to protect your systems from software supply chain attacks:

1. Verify the integrity of software downloads.
2. Implement strong authentication and access controls.
3. Keep software up to date and apply security patches.
4. Conduct regular security audits and vulnerability assessments.

FAQs: Clearing the Air

• What is the Smooth Operator campaign? The Smooth Operator campaign is an ongoing cyberattack that targets software supply chains, specifically 3CX software, by trojanizing it.
• How do I protect myself from software supply chain attacks? Keep your software up to date, verify the integrity of downloads, implement strong authentication, and conduct regular security audits.
• There is conflicting information everywhere on this; does this affect both the beta 18.12.407 and the final 18.12.416? Yes, you must uninstall the RC client as well. It only affects the Electron app, not the server or the PWA web view.
• I have seen reports that the PBX instances themselves have also been compromised. Is there any truth to this, or is it just the client app for Windows?
• The primary issue lies with the compromised Desktop App for Windows. However, if your extension is the system owner, the PBX could be affected. The main point of entry remains the Electron app.
• Where can I find more information about the Smooth Operator campaign? For a comprehensive overview, visit https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/.

Stay One Step Ahead of the Smooth Operator

The Smooth Operator campaign is a stark reminder that cybercriminals always look for vulnerabilities to exploit. By staying informed and adopting best practices, you can defend

your systems against software supply chain attacks like the one targeting 3CX software. Remember, knowledge is power, so keep a close eye on the latest cybersecurity news and developments, including updates on this cyber attack. You can keep your digital assets safe and secure by staying vigilant and proactive.

Embracing a Culture of Security Awareness

As cyberattacks continue to evolve, fostering a culture of security awareness within your organization is more important than ever. Encourage open communication and collaboration between departments, and provide regular training to employees on best practices for identifying and avoiding potential threats.

Key Elements of Security Awareness

• Recognize phishing emails and suspicious links.
• Understand the importance of strong passwords and multi-factor authentication.
• Know how to report potential security incidents
• Stay informed about emerging threats and vulnerabilities

Sharing Knowledge: The Key to Cyber Resilience

The fight against cybercrime is a collaborative effort. Share information and insights with other organizations, industry peers, and cybersecurity professionals to build a strong defense against emerging threats. By pooling resources and knowledge, we can better anticipate and mitigate the risks associated with software supply chain attacks like the Smooth Operator campaign.

Staying Connected: Cybersecurity Resources

• Subscribe to cybersecurity newsletters and blogs
• Participate in industry conferences and events
• Engage in online forums and communities
• Collaborate with cybersecurity experts and service providers

In conclusion, staying one step ahead of the Smooth Operator and other software supply chain attacks requires constant vigilance, ongoing education, and a commitment to cybersecurity best practices. By fostering a culture of security awareness and collaborating with other professionals in the field, you can protect your organization and contribute to a safer digital landscape for everyone. Don’t forget to watch https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/ for the latest updates and information.

Stay safe out there!