Supply Chain Attack on 3CX: digital attack on popular enterprise VoIP software. (CVE-2023-29059)

The following commands allow you to establish the presence of 3CX on devices within your organization:

Windows systems

# Checking if there is an active process related to 3CX

Get-WmiObject -Class Win32_Process -Filter "Name='3CXDesktopApp.exe'"

# Checking Windows registry

Get-ItemProperty -Path 'HKLM:【OFTWARE】' -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like '3CX Desktop App' }

# Control of 3CX user profiles.

Test-Path -Path C:C:C.

MacOS systems

# Check for presence of program on macOS in /Applications

ls '/Applications' | grep '3CX'

# Checking for the presence of a folder within Application support folder

if [ -d /Users/*/Library/Application Support/3CXDesktop App/ ]; then echo "3CXDesktop exists"; fi

It is important for your organization to take at least the following steps:

1. Check publicly available Indicators-of-Compromise (IoCs) on your systems to determine if any systems may have been compromised, or have external preventive research performed on your systems.
   1. Following the opinion of the NCSC advises NFIR to remove the rogue versions of the 3CX software and wait until a "safe" version is published by the software vendor - in the meantime, 3CX recommends using the PWA variant of the application - 3CX Security Alert for Electron Windows App | Desktop App.
2. Prepare your organization for the situation when patches need to be executed unexpectedly (outside the regular update timeframes) and apply patches in a controlled manner according to the procedure usual for your organization.
3. If your organization is using 3CX, NFIR recommends always having forensics performed to determine if your environment has been compromised.

Do you have systems where the risk is high (for example, systems with very sensitive or special personal data)? If so, do you possibly have indications that the system cannot be mitigated and/or updated immediately? Then consider temporarily disabling the system until it can be updated.

If your organization is suspected to have been the victim of an attack, the urgent advice is to have research conducted into the cause, to what extent attackers may have compromised other systems and what information may have been accessed unauthorized.

1. If possible, disconnect affected systems from the network, but leave them on (in connection with any traces such as volatile memory - RAM);
2. Have the affected systems forensically examined; ensure adequate backups;
3. Reset your passwords and user data;
4. Report to the Police;
5. Consider filing a report with the Personal Data Authority.

Does your organization currently have an incident? Our Computer Emergency Response Teams
(CERT) are available to organizations 24/7 to support IT Security Incidents.
Then call 088 133 0700 and we will do our best to help you as soon as possible.

Learn more about our Incident Response Service