3CX DesktopApp Supply Chain Attack Also Detected in Korea

On March 29, 2023, CrowdStrike announced that a threat group based in North Korea launched a supply chain attack through 3CX DesktopApp. [1] With this app, the threat actor installed an Infostealer in the target system.

AhnLab Security Emergency response Center (ASEC) previously announced a 3CX DesktopApp supply chain attack in the following blog post alongside mitigation measures. [2] This post will provide an analysis of the malware used in the attacks and logs of their infection in Korea collected …

3cx actor ahnlab analysis app asd asec attack attacks blog blog post center crowdstrike defense desktopapp emergency infection infostealer korea logs malware malware analysis march mitigation north north korea response security smart supply supply chain supply chain attack system target threat threat actor threat group