Security News > 2023 > April > An earlier supply chain attack led to the 3CX supply chain attack, Mandiant says
The supply-chain attack against 3CX last month was caused by an earlier supply-chain compromise of a different software firm - Trading Technologies - according to Mandiant, whose consulting crew was hired by 3CX to help the VoIP biz investigate the intrusion.
"This is the first time that we've ever found concrete evidence of a software supply chain attack leading to another software supply chain attack," Mandiant Consulting CTO Charles Carmakal told reporters on Wednesday.
This, of course, also means that 3CX probably wasn't the only company compromised in the earlier supply-chain attack.
"In terms of the actual distribution of compromise software for 3CX, it's our understanding that that occurred in 2023.".
In 2023, a 3CX employee downloaded the malware-laced X Trader software.
This allowed the attacker to compromise the employee's computer, deploy a bunch of malware, move laterally through the 3CX environment and ultimately infect the 3CX DesktopApp software with malware-laden code that was available for download on the 3CX website.
News URL
https://go.theregister.com/feed/www.theregister.com/2023/04/20/3cx_supply_chain_attack/
Related news
- China-Linked Silk Typhoon Expands Cyber Attacks to IT Supply Chains for Initial Access (source)
- GitHub supply chain attack spills secrets from 23,000 projects (source)
- Supply chain attack on popular GitHub Action exposes CI/CD secrets (source)
- Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos (source)
- GitHub Action hack likely led to another in cascading supply chain attack (source)
- GitHub Action supply chain attack exposed secrets in 218 repos (source)
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed (source)
- ⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More (source)
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)
- SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack (source)