3CX: How this malware almost hacked every business

TL;DR

A malware attack through the popular business phone book software, 3CX Desktop App, has infected computers of large companies, exposing them to information theft and remote control by hackers.

Transcript

so you could download the official 3cx desktop app which is basically like Skype it would be signed as you can see the digital signatures match the actual company but the moment you run this your computer would be infected with the malware payload which includes things like an infostealer a back door for the attackers and potentially even the abili... Read More

Key Insights

• 💁 The 3CX Desktop App, widely used by large companies, was infected with malware, exposing sensitive information and control of infected computers.
• 🪡 The initial response from 3CX staff on the forums was dismissive and shifted blame, highlighting the need for better incident response and customer support.
• 👨‍💻 The attackers used sophisticated techniques, including encrypted payloads and obfuscated code, making it difficult for analysts to detect the threat.
• 📁 The incident emphasizes the ongoing threat of malware and the importance of using comprehensive antivirus software that scans various file types, not just .exe files.
• 😀 The attack indicates the potential vulnerability of other widely used business apps and highlights the need for better cybersecurity measures in large organizations.
• 😀 Users and businesses should remain vigilant and prioritize cybersecurity, as even official and trusted apps can be compromised.
• 🤨 The malware attack raises concerns about the preparedness of large companies for cybersecurity incidents and the potential impact on customer trust.

Questions & Answers

Q: How did the malware attack on the 3CX Desktop App occur?

The attack was detected when CrowdStrike observed suspicious connections and malicious activity coming from the legitimate 3CX binary. The attackers exploited vulnerabilities and injected malicious code into the software.

Q: What were the consequences of the malware attack?

The malware payload included an infostealer, a backdoor for attackers, and potentially full control over infected computers. This compromised the security and privacy of large organizations using the 3CX Desktop App.

Q: How did 3CX initially respond to the reports of malware payloads?

Initially, 3CX staff on their forums shifted blame and denied responsibility, banning users who raised concerns. However, the CEO later released a statement expressing care for transparency and cybersecurity.

Q: Why is this malware attack significant for businesses?

The incident highlights the unpreparedness of many large companies for malware attacks. It shows that even official apps can be compromised, posing a risk to all businesses using the affected software.

Summary & Key Takeaways

• The 3CX Desktop App, used by many large companies, was compromised, allowing hackers to infect computers with malware payloads.

• The attack was initially detected by CrowdStrike, who observed malicious activity and connections to hacker infrastructure from the legitimate 3CX binary.

• The malware attack highlights the lack of preparedness of large companies and emphasizes the ongoing threat of malware despite improved security measures.