Earlier today CrowdStrike reported a supply chain attack targeting the 3CX Voice Over Internet Protocol (VOIP) Windows desktop client.
- 600,000 companies use it
- 12,000,000 users
- Sophos has identified a MacOS variant infected
- Currently attributed to Lazarus Group
- 600,000 companies use it
- 12,000,000 users
- Sophos has identified a MacOS variant infected
- Currently attributed to Lazarus Group
🤯16❤4👍4🤔3🫡3🥰1
Prior to CrowdStrike's report - customers went to the 3CX forums expressing concerns that EDRs were reporting suspicious activity. EDRs from CrowdStrike, ESET, PaloAltoNtwks, and SentinelOne flagged the binary. 3CX said they were wrong.
Images via malwrhunterteam
Images via malwrhunterteam
🤣20🤔5👍2🤪2❤1
SentinelOne has released an in-depth analysis of the malware and payload, they have dubbed it 'SmoothOperator'. The final payload exfiltrates data from web browsers Chrome, Edge, Brave, and Firefox.
tl;dr largest data theft in history?
https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
tl;dr largest data theft in history?
https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
SentinelOne
3CX SmoothOperator | 3CXDesktopApp in Supply Chain Attack
Explore the intricacies of 3CX Smooth Operator. Learn about the multi-stage attack chain and infostealer malware delivery at scale.
🤯20🤪3
We have malware samples from the recent 3CX VOIP supply chain attack.
- SmoothOperator.7z
- 48.1MB compressed
- Samples from CrowdStrike and SentinelOne reports
You can download the malware samples here: https://share.vx-underground.org/
- SmoothOperator.7z
- 48.1MB compressed
- Samples from CrowdStrike and SentinelOne reports
You can download the malware samples here: https://share.vx-underground.org/
🔥27🥰4👍2
MacOS malware expert patrickwardle has been covering the MacOS variant of the 3CX VOIP supply chain attack.
Additionally, we have managed to get our hands on the MacOS variant.
Download: https://share.vx-underground.org
Analysis: https://twitter.com/patrickwardle/status/1641294247877021696
Additionally, we have managed to get our hands on the MacOS variant.
Download: https://share.vx-underground.org
Analysis: https://twitter.com/patrickwardle/status/1641294247877021696
Twitter
RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
...let's dive in!…
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
...let's dive in!…
🤯10❤4👍2💯1
Very cool, thanks for supporting vx-underground, LeBron James
🤣45🤪19🔥10😁4🤔3❤2🤯1😘1
Hello,
If you're a person who possesses the recently leaked Vulkan files, and would be kind enough to share them with us, we would appreciate it. We would like to read them.
Thank you.
https://www.theguardian.com/technology/2023/mar/30/vulkan-files-leak-reveals-putins-global-and-domestic-cyberwarfare-tactics
If you're a person who possesses the recently leaked Vulkan files, and would be kind enough to share them with us, we would appreciate it. We would like to read them.
Thank you.
https://www.theguardian.com/technology/2023/mar/30/vulkan-files-leak-reveals-putins-global-and-domestic-cyberwarfare-tactics
the Guardian
‘Vulkan files’ leak reveals Putin’s global and domestic cyberwarfare tactics
Vulkan engineers have worked for Russian military and intelligence agencies to support hacking operations, prepare for attacks on infrastructure and spread disinformation
👍43🤣20🫡8😁5💯5❤2🔥2🤩1
The 3CX CEO stated that the supply chain attack that occured wasn't their fault, rather it was the result of an upstream vendor being compromised, suggesting FFmpeg, because this is where the malware payload resides
FFmpeg denies this because they don't release compiled binaries
FFmpeg denies this because they don't release compiled binaries
😁49🤯9🤣7🤔1
During the SolarWinds supply chain attack, the CEO blamed the intern. Now, a CEO must blame the free and open source library.
🤪27💯19😁13
This media is not supported in your browser
VIEW IN TELEGRAM
🔥60🥰8😍8💯6🤩5😁2❤🔥1
🚨 !!!!BREAKING!1!! 🚨
vx-underground, the infamous hacker forum and ransomware aktivist collective, has had their domain seized by EUROPOL
!!!!ALL PASSWORDS HAVE BEEN CHANGED!!!!
vx-underground, the infamous hacker forum and ransomware aktivist collective, has had their domain seized by EUROPOL
!!!!ALL PASSWORDS HAVE BEEN CHANGED!!!!
🤣165🫡17🤯16😁9🤪8😱6😢6🎉6🤔2💯2🥰1
If you or a person you know has been a victim of vx-underground, please contact Joe Biden
😁74🫡58🤣33👍5🤯5😱4🎉4🤪3
Haha April Fool's.
We gotcha so good, you frickin nerds 😎
We gotcha so good, you frickin nerds 😎
🤯67🤪19😘9🫡8🥰6😱5😁3🎉3😢2🙏1💯1
Our website has been restored. The prank is over.
Please download malware.
https://www.vx-underground.org/
Please download malware.
https://www.vx-underground.org/
🥰39🤪14🤣9🫡7🤔2❤1😱1