3CX Supply Chain Attack

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with AppleJeus, access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.(Citation: Mandiant 3cx UNC4736 2023) While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.(Citation: Kaspersky 3CX Gopuram 2023) The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.(Citation: 3cx official statement 2023)(Citation: Krebs 3cx overview 2023)

This is a historical record and does not establish current campaign activity.

Threat actor

AppleJeus

Attribution confidence

Not established

First documented activity

2022-11-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-11-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2023-03-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1027 · Obfuscated Files or Information

  Stealth — During the 3CX Supply Chain Attack, AppleJeus payloads use AES-256 GCM cipher to encrypt data to include ICONICSTEALER and VEILEDSIGNAL.(Citation: Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023)(Citation: Mandiant 3cx UNC4736 2023)

• T1559 · Inter-Process Communication

  Execution — During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL creates and listens on a Windows named pipe to exchange messages between modules.(Citation: Mandiant 3cx UNC4736 2023)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During 3CX Supply Chain Attack, AppleJeus has gained access to the 3CX corporate environment through legitimate VPN credentials.(Citation: 3cx official statement 2023)

• T1195.002 · Compromise Software Supply Chain

  Initial Access — During the 3CX Supply Chain Attack, AppleJeus first compromised an “end-of-life" trading software application which was downloaded and executed inside the 3CX enterprise environment. The second compromise modified the Windows and macOS build environments used to distribute the 3CX software to their customer base.(Citation: Mandiant 3cx UNC4736 2023)

• T1189 · Drive-by Compromise

  Initial Access — During the 3CX Supply Chain Attack, AppleJeus compromised the `www.tradingtechnologies[.]com` website hosting a hidden IFRAME to exploit visitors, two months before the site was known to deliver a compromised version of the X_TRADER software package.(Citation: Mandiant 3cx UNC4736 2023)

• T1543.004 · Launch Daemon

  Persistence, Privilege Escalation — During the 3CX Supply Chain Attack, AppleJeus installs a Launch Daemon to execute the POOLRAT macOS backdoor software.(Citation: Mandiant 3cx UNC4736 2023)

• T1678 · Delay Execution

  Stealth — During the 3CX Supply Chain Attack, AppleJeus's software generates a randomly selected date that is between 1-4 weeks in the future. This timestamp is then checked against the current time of the compromised machine, and the malware will sleep until that time is encountered.(Citation: Unit42 3cx supply chain 2023)

• T1218.007 · Msiexec

  Stealth — During the 3CX Supply Chain Attack, AppleJeus delivered components using a Windows Installer package (.msi). The MSI installer extracted several files and executed the 3CXDesktopApp.exe, which loaded the malicious library file ffmpeg.dll.(Citation: Unit42 3cx supply chain 2023)

• T1102.001 · Dead Drop Resolver

  Command And Control — During the 3CX Supply Chain Attack, AppleJeus leveraged a GitHub repository to host icon files containing the command and control URL.(Citation: Unit42 3cx supply chain 2023)(Citation: Mandiant 3cx UNC4736 2023)

• T1574.001 · DLL

  Stealth, Execution — During the 3CX Supply Chain Attack, AppleJeus splits functionally across multiple .dll files using export functions, such as DLLGetClassObject, to execute code from an embedded .dll file within another .dll file. AppleJeus has also used DLL search order hijacking via the IKEEXT service, running with LocalSystem privileges, to load the TAXHAUL DLL for persistence.(Citation: Unit42 3cx supply chain 2023)(Citation: Mandiant 3cx UNC4736 2023)

• T1620 · Reflective Code Loading

  Stealth — During the 3CX Supply Chain Attack, AppleJeus leverages the publicly available open-source project DAVESHELL to convert PE-COFF files to position-independent code to reflectively load the payload into memory.(Citation: Mandiant 3cx UNC4736 2023)(Citation: Daveshell sRDI GitHub shell code loader)

• T1553.002 · Code Signing

  Defense Impairment — Although the X_TRADER platform was reportedly discontinued in 2020, it was still available for download from the legitimate Trading Technologies website in 2022. During the 3CX Supply Chain Attack, AppleJeus used a code signing certificate to digitally sign the malicious software with an expiration date set to October 2022. This file was signed with the subject “Trading Technologies International, Inc” and contained the executable file Setup.exe, also signed with the same digital certificate.(Citation: Mandiant 3cx UNC4736 2023)(Citation: 3cx official statement 2023)

• T1217 · Browser Information Discovery

  Discovery — During the 3CX Supply Chain Attack, AppleJeus leveraged ICONICSTEALER to steal browser information to include browser history located on the infected host.(Citation: Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023)(Citation: Mandiant 3cx UNC4736 2023)(Citation: Trend Micro 3CX AppleJeus ICONICSTEALER March 2023)

• T1055 · Process Injection

  Stealth, Privilege Escalation — During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL uses process injection to inject the C2 communication module code in the first found process instance of Chrome, Firefox, or Edge web browsers. It also monitors the established named pipe and re-injects the C2 communication module if necessary.(Citation: Mandiant 3cx UNC4736 2023)

• T1027.013 · Encrypted/Encoded File

  Stealth — During the 3CX Supply Chain Attack, AppleJeus encrypts its dynamic library files (.dll) using RC4, and when loaded only decrypts specific portions of the file using the key `3jB(2bsG#@c7`.(Citation: Unit42 3cx supply chain 2023)

• T1071.001 · Web Protocols

  Command And Control — During the 3CX Supply Chain Attack, AppleJeus's COLDCAT C2 leverages cookie headers to contain data over HTTPS. Cookies also contain hardcoded variables `__tutma` or `__tutmc` in the payload's HTTPS request.(Citation: Mandiant 3cx UNC4736 2023)(Citation: Unit42 3cx supply chain 2023)

• T1027.009 · Embedded Payloads

  Stealth — During the 3CX Supply Chain Attack, AppleJeus uses embedded .dll as apart of a chained delivery mechanism to invoke the COM class factory.(Citation: Unit42 3cx supply chain 2023)

• T1573.001 · Symmetric Cryptography

  Command And Control — During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL communication module supports three commands to conduct the following actions: send implant data, execute shellcode, and terminate itself.(Citation: Mandiant 3cx UNC4736 2023)

• T1546.016 · Installer Packages

  Privilege Escalation, Persistence — During the 3CX Supply Chain Attack, AppleJeus added a malicious .dylib file to a .dmg installer package for the macOS 3CX application.(Citation: Unit42 3cx supply chain 2023)

• T1055.002 · Portable Executable Injection

  Stealth, Privilege Escalation — During the 3CX Supply Chain Attack, AppleJeus uses the SigFlip tool to inject arbitrary code without affecting or breaking the file's signature.(Citation: GitHub SigFlip opensource tool)(Citation: Mandiant 3cx UNC4736 2023)

• T1218.015 · Electron Applications

  Stealth — During the 3CX Supply Chain Attack, AppleJeus leveraged the 3CX application's electron framework to execute its malicious libraries under the official 3CX electron application.(Citation: Unit42 3cx supply chain 2023)

• T1203 · Exploitation for Client Execution

  Execution — During the 3CX Supply Chain Attack, AppleJeus leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website.(Citation: Mandiant 3cx UNC4736 2023)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0057

  Official MITRE ATT&CK campaign record C0057. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.