3CX Desktop Attack: Sophos Partner and Customer Information

Resources•Managed Detection and Response (MDR)•Sophos Endpoint•Sophos X-Ops•Sophos XDR•Threats & Malware
Mar 31 2023 By

Sophos X-Ops is tracking an attack against the 3CX Desktop application, possibly undertaken by a nation-state-related group.

The affected software is 3CX – a legitimate software-based PBX phone system available on Windows, Linux, Android, and iOS. The application has been abused by the threat actor to add an installer that communicates with various command-and-control (C2) servers.

A list of IOCs for this attack is published on our GitHub.

Sophos protection

Sophos has taken the following actions to protect customers from this attack:

  • Blocked the malicious domains
  • Published the following detections:Static detections:
    • Troj/Loader-AF (Trojanized ffmpeg.dll)
    • Troj/Mdrop-JTQ (installers)
    • OSX/Mdrop-JTR (installers)
    • OSX/Loader-AG (Trojanized ffmpeg.dll)

    Reputation detection:

    • Mal/Generic-R / Mal/Generic-S (d3dcompiler with appended shellcode)

    Memory detection:

    • Mem/Loader-AH
  • Blocked the list of known C2 domains associated with the threat, and will continue to add to that list
  • Flagged the two malicious versions of the ffmpeg.dll bundled in the affected 3CXapplication as being of low reputation
  • For Sophos MDR customers, the MDR Detection Engineering team has a variety of behavioral detections in place that will detect follow up activity

Determining impact with Sophos XDR

Sophos XDR enables organizations to determine whether hosts have communicated with threat actor infrastructure. We have created a custom query that is available here.

More information

For further insights into the attack, read the article from Sophos X-Ops here.

We also recommend that users of 3CX’s software monitor the company’s blog and support forum.

About the Author

Sophos is a global leader and innovator of advanced security solutions for defeating cyberattacks, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies. As one of the largest pure-play cybersecurity providers, Sophos defends more than 600,000 organizations and more than 100 million users worldwide from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through the Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully managed security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.