3CX blames North Korea for massive supply chain hack

Business phone provider 3CX has confirmed that North Korean-backed hackers were behind last month’s supply chain attack that appeared to target cryptocurrency companies.

3CX, which provides voice, video conferencing and online messaging services for businesses, worked with cybersecurity firm Mandiant to investigate the attack. Hackers have compromised corporate desk phone software used by hundreds of thousands of organizations to plant information-stealing malware in their customers’ corporate networks.

3CX IT security manager Pierre Jourdan said on Tuesday that their investigation confirmed that hackers linked to the North Korean regime were behind the attack.

“Based on Mandiant’s investigation of the 3CX intrusion and supply chain attack so far, they attribute the activity to a cluster named UNC4736,” Jourdan said. “Mandiant assesses with great confidence that UNC4736 has a connection to North Korea.”

Cybersecurity giant CrowdStrike last week linked the 3CX breach to hackers it calls Labyrinth Chollima, a subunit of the notorious Lazarus Group, known for stealth hacks targeting cryptocurrency exchanges to fund its scheme. of nuclear weapons. Russia-based Kaspersky Lab also attributed the 3CX breach to North Korea.

Kaspersky said in its analysis of the attack that hackers were seen deploying a backdoor, which it named “Gopuram”, on infected systems, noting that the attackers have “a specific interest in companies of cryptocurrency”. Kaspersky added that Gopuram was deployed on less than ten machines, indicating that the attackers used this backdoor with “surgical precision”.

In a forum post last week, 3CX CEO Nick Galea said the company was only aware of “a handful of cases” where malware was triggered. However, the impact of the attack, as well as how 3CX was compromised, remains unknown. 3CX claims to have over 600,000 business customers worldwide and over 12 million daily active users.