{"id":14909,"date":"2023-03-31T11:11:21","date_gmt":"2023-03-31T09:11:21","guid":{"rendered":"http:\/\/nfirjun2026.local\/supply-chain-attack-on-3cx-digital-attack-on-popular-enterprise-voip-software-cve-2023-29059\/"},"modified":"2024-02-12T14:12:57","modified_gmt":"2024-02-12T13:12:57","slug":"supply-chain-attack-on-3cx-digital-attack-on-popular-enterprise-voip-software-cve-2023-29059","status":"publish","type":"post","link":"https:\/\/www.cyber-security-online.nl\/en\/supply-chain-attack-on-3cx-digital-attack-on-popular-enterprise-voip-software-cve-2023-29059\/","title":{"rendered":"Supply Chain Attack on 3CX: digital attack on popular enterprise VoIP software. (CVE-2023-29059)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

On March 30, Cybersecurity firm CrowdStrike <\/a>said it had observed a digital attack on users of the software package 3CX. This attack is also called a supply chain attack – in which a software vendor’s distribution and\/or update channels are abused to distribute rogue software. <\/strong><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

3CX is a widely used and comprehensive Voice-over-IP (VoIP) software solution for businesses, used by telephone exchanges, among others. NFIR advises users of this software to take immediate action. The attack has been assigned the CVE number CVE-2023-29059<\/a>.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tThe affected versions of the 3CX VoIP product involve at least the following:\n\n\n\n\n\n\n
Product<\/strong><\/td>\nPlatform<\/strong><\/td>\n<\/tr>\n
3CX version 18.12.407
\n3CX version 18.12.416<\/td>\n		Electron Windows<\/td>\n<\/tr>\n
3CX version 18.11.1213<\/td>\nElectron MacOS 18.11<\/td>\n<\/tr>\n
3CX version 18.12.402
\n3CX version 18.12.407
\n3CX version 18.12.416<\/td>\n		Electron MacOS 18.12<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nNFIR recommends determining whether rogue versions of 3CX as described above are present on systems within your organization. The rogue versions are distributed by a rogue piece of software in 3CX Desktop App update 7. This update has been available since the end of March 2023, according to 3CX. If you detect an infected version, NFIR recommends incident response & digital forensics.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
3CX Wikipedia<\/a><\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t<\/i>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\tDownload the Threat Intelligence Report on vulnerability in Confluence (CVE-2022-26134) here.<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n\t\t\t\t\t
\n\t\t\t\t
<\/div>\n\t\t\t\t
<\/div>\n\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\tNeed immediate help?\t\t\t\t\t<\/h2>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Then call our 24\/7 CERT line at 088 133 0700<\/a> and we will do
\nour best efforts to help you as quickly as possible.<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\n\t\t\t\t\t\tCall us now\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat potential impact does this Confluence vulnerability have?<\/a>\n\t\t\t\t\t<\/h4>\n\t\t\t\t\t

The following commands allow you to establish the presence of 3CX on devices within your organization:<\/p>

Windows systems<\/strong><\/h3>

# Checking if there is an active process related to 3CX<\/p>

Get-WmiObject -Class Win32_Process -Filter “Name=’3CXDesktopApp.exe'”<\/p>

# Checking Windows registry<\/p>

Get-ItemProperty -Path ‘HKLM:\u3010OFTWARE\u3011’ -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like ‘3CX Desktop App’ }<\/p>

# Control of 3CX user profiles.<\/p>

Test-Path -Path C:C:C.<\/p><\/blockquote>

MacOS systems<\/strong><\/h3>

# Check for presence of program on macOS in \/Applications<\/p>

ls ‘\/Applications’ | grep ‘3CX’<\/p>

# Checking for the presence of a folder within Application support folder<\/p>

if [ -d \/Users\/*\/Library\/Application Support\/3CXDesktop App\/ ]; then echo “3CXDesktop exists”; fi<\/p><\/blockquote><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tHow is the Confluence vulnerability detectable?<\/a>\n\t\t\t\t\t<\/h4>\n\t\t\t\t\t
Based on publicly available information, at least the following rogue domain names have been identified:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Domain names<\/strong><\/td>\n<\/tr>\n
akamaicontainer[.]com<\/td>\nmsedgepackageinfo[.]com<\/td>\n<\/tr>\n
akamaitechcloudservices[.]com<\/td>\nmsstorageazure[.]com<\/td>\n<\/tr>\n
azuredeploystore[.]com<\/td>\nmsstorageboxes[.]com<\/td>\n<\/tr>\n
azureonlinecloud[.]com<\/td>\nofficeaddons[.]com<\/td>\n<\/tr>\n
azureonlinestorage[.]com<\/td>\nofficestoragebox[.]com<\/td>\n<\/tr>\n
dunamistrd[.]com<\/td>\npbxcloudeservices[.]com<\/td>\n<\/tr>\n
glcloudservice[.]com<\/td>\npbxphonenetwork[.]com<\/td>\n<\/tr>\n
qwepoi123098[.]com<\/td>\nzacharryblogs[.]com<\/td>\n<\/tr>\n
sbmsa[.]wiki<\/td>\npbxsources[.]com<\/td>\n<\/tr>\n
sourceslabs[.]com<\/td>\njournalide[.]org<\/td>\n<\/tr>\n
visualstudiofactory[.]com<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nNFIR recommends configuring the above domain names within IDS\/IPS\/EDR solutions as detection rules. This is an ongoing current situation in which new indicators of an infection may become available. If you suspect you have been affected by this supply-chain attack, NFIR advises you to have incident response & forensic investigations done into whether your systems have been affected.<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tIs there an action plan that your organization can follow? <\/a>\n\t\t\t\t\t<\/h4>\n\t\t\t\t\t

It is important for your organization to take at least the following steps:<\/p>

  1. Check publicly available Indicators-of-Compromise (IoCs) on your systems to determine if any systems may have been compromised, or have external preventive research performed on your systems.
    1. Following the opinion of the NCSC<\/a> advises NFIR to remove the rogue versions of the 3CX software and wait until a “safe” version is published by the software vendor – in the meantime, 3CX recommends using the PWA variant of the application – 3CX Security Alert for Electron Windows App | Desktop App<\/a>.<\/li><\/ol><\/li>
    2. Prepare your organization for the situation when patches need to be executed unexpectedly (outside the regular update timeframes) and apply patches in a controlled manner according to the procedure usual for your organization.<\/li>
    3. If your organization is using 3CX, NFIR recommends always having forensics performed to determine if your environment has been compromised.<\/li><\/ol>

      Do you have systems where the risk is high (for example, systems with very sensitive or special personal data)? If so, do you possibly have indications that the system cannot be mitigated and\/or updated immediately? Then consider temporarily disabling the system until it can be updated.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

      \n\t\t\t\t\t

      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat should your organization do in case of potential abuse?<\/a>\n\t\t\t\t\t<\/h4>\n\t\t\t\t\t

      If your organization is suspected to have been the victim of an attack, the urgent advice is to have research conducted into the cause, to what extent attackers may have compromised other systems and what information may have been accessed unauthorized.<\/p>

      1. If possible, disconnect affected systems from the network, but leave them on (in connection with any traces such as volatile memory – RAM);<\/li>
      2. Have the affected systems forensically examined; ensure adequate backups;<\/li>
      3. Reset your passwords and user data;<\/li>
      4. Report to the Police;<\/li>
      5. Consider filing a report with the Personal Data Authority.<\/li><\/ol>

        Does your organization currently have an incident? Our Computer Emergency Response Teams <\/a>
        (CERT) are available to organizations 24\/7 to support IT Security Incidents.
        Then call         088 133 0700<\/a> and we will do our best to help you as soon as possible.<\/p>

        Learn more about our Incident Response Service<\/a><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Does your organization currently have an incident? Our Computer Emergency Response Teams (CERT) are available to organizations 24\/7 to support IT Security Incidents.<\/p>\n

        Then call 088 133 0700<\/a> and we will do our best to help you as soon as possible. Here you will find more information about our Incident Response <\/a>service.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t
        \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t<\/i>\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\tDownload the Threat Intelligence Report on vulnerability in Confluence (CVE-2022-26134) here.<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t

        Disclaimer: NFIR has made every effort to make this information accurate and reliable. However, the information provided is without any guarantee of any kind and its use is entirely at the risk of the user. NFIR assumes no responsibility or liability for the accuracy, content, completeness, legality or reliability of the information provided.<\/em><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

        On March 30, Cybersecurity firm CrowdStrike said it had observed a digital attack on users of the software package 3CX. This attack is also called […]<\/p>\n","protected":false},"author":4,"featured_media":14556,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_seopress_titles_title":"Threat intel report: supply chain attack on 3CX: digital attack on popular enterprise VoIP software. (CVE-2023-29059)","_seopress_titles_desc":"Cybersecurity firm CrowdStrike has observed a supply chain attack, CVE-2023-29059, on users of the software package 3CX. Find out here how your organization can protect itself from this attack: indicators of compromise, detection rules and steps to protect your organization.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"40","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.cyber-security-online.nl\/wp-content\/uploads\/2023\/03\/koeleman-a-photorealistic-image-of-a-laptop-with-a-headset-that-e4af4612-f73e-4f42-bd2e-42920f0f36e3-1-.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.cyber-security-online.nl\/wp-content\/uploads\/2023\/03\/koeleman-a-photorealistic-image-of-a-laptop-with-a-headset-that-e4af4612-f73e-4f42-bd2e-42920f0f36e3-1-.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"both","_seopress_redirections_param":"","_seopress_redirections_type":301,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"default","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[29,51],"tags":[],"class_list":["post-14909","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-media-en","category-threat-intelligence-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/posts\/14909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/comments?post=14909"}],"version-history":[{"count":0,"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/posts\/14909\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/media\/14556"}],"wp:attachment":[{"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/media?parent=14909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/categories?post=14909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cyber-security-online.nl\/en\/wp-json\/wp\/v2\/tags?post=14909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}