November 8, 2023
The incident responders investigating how hackers carried out a complex supply-chain attack targeting enterprise phone provider 3CX say the company was compromised by another supply chain attack.
3CX, which develops a software-based phone system used by over 600,000 organizations worldwide with more than 12 million active daily users, worked with cybersecurity company Mandiant to investigate the incident. In its report released on Thursday, Mandiant said that attackers compromised 3CX using a malware-laced version of the X_Trader financial software, developed by Trading Technologies.
X_Trader was a platform used by traders to view real-time and historical markets, which Trading Technologies phased out in 2020, but Mandiant says was still available to download from the company’s website in 2022.
Mandiant said it suspects the Trading Technologies website was compromised by a group of North Korea state-backed hackers, which it refers to as UNC4736.
This is backed up by a report from Google’s Threat Analysis Group from last year, which confirmed that Trading Technologies’ website was compromised in February 2022 as part of a North Korean operation targeting dozens of cryptocurrency and fintech users. U.S. cybersecurity agency CISA says the hacking group has used its custom “AppleJeus” malware to steal cryptocurrency from victims in over 30 countries.
Mandiant’s investigation found that a 3CX employee downloaded a tainted version of the X_Trader software in April 2022 from Trading Technologies’ website, which the hackers had digitally signed with the company’s then-valid code signing certificate to make it look as if it was legitimate.
Once installed, the software planted a backdoor on the employee’s device, giving the attackers full access to the compromised system. This access was then used to move laterally through 3CX’s network and, eventually, to compromise 3CX’s flagship desktop phone app to plant information-stealing malware inside their customers’ corporate networks.
“This is notable to us because this is the first time we’ve ever found concrete evidence of a software supply chain attack leading to another supply chain attack,” said Mandiant’s chief technology officer Charles Carmakal. “This series of coupled supply-chain attacks just illustrates the increasing cyber offensive cyber capability by North Korean threat actors.”
Mandiant says it notified Trading Technologies about the compromise on April 11 but says it’s not known how many users are affected.
Trading Technologies spokesperson Ellen Resnick told TechCrunch that the company has not yet verified Mandiant’s findings, and reiterated that it stopped supporting the software in 2020.
Mandiant’s Carmakel added that it’s likely “many more victims” related to the two supply-chain attacks will become known in the coming weeks and months.
Source: techcrunch
Original link: https://techcrunch.com/2023/04/20/3cx-supply-chain-xtrader-mandiant/
OFFICIALLY ISSUE THE LAW ON PERSONAL DATA PROTECTION Source: Hoàng Ngọc – People’s Deputies Online On the morning of June 26, under the chairmanship of Vice President of the National Assembly, Senior Lieutenant General Trần Quang Phương, the National Assembly voted to pass the Law on Personal Data Protection with 433 out of 435 deputies […]
Learn more
💥 IN-HOUSE DPO VS. OUTSOURCED DPO – WHICH SOLUTION SAVES COSTS AND ENSURES COMPLIANCE? 🔒 Decree No. 13/2023 and the Draft Law on Personal Data Protection require all businesses to appoint a Data Protection Officer (DPO). The draft law explicitly gives businesses the right to choose between appointing an internal DPO or engaging […]
Learn more
🌟 THE DPO AND A CULTURE OF DATA PROTECTION – THE KEY TO BUILDING LASTING TRUST In the digital age, personal data is both a valuable asset and a vulnerable one. That’s why the role of the Data Protection Officer (DPO) goes beyond legal compliance—it serves as a foundation for embedding a strong culture of […]
Learn more