3CX Supply Chain Attack (CVE-2023-29059): The First Cascading Software Compromise

Executive Summary

On March 29, 2023, multiple security vendors disclosed that the 3CX DesktopApp — a softphone client distributed by a VoIP vendor whose customer base numbers in the hundreds of thousands — had been shipping with embedded malicious code. The trojanised builds were digitally signed by 3CX, delivered through 3CX's own update channel, and indistinguishable from legitimate software at the point of installation. The compromise was assigned CVE-2023-29059 and affected the Electron Windows application versions 18.12.407 and 18.12.416 shipped in Update 7, and macOS versions 18.11.1213, 18.12.402, 18.12.407 and 18.12.416.

What elevates this incident beyond a conventional supply chain attack emerged three weeks later. On April 20, 2023, Mandiant published the findings of its incident response engagement: the initial compromise of 3CX's network had itself come from a software supply chain attack. A 3CX employee had downloaded X_TRADER, a trading platform from Trading Technologies, onto a personal computer. That installer — served from Trading Technologies' own website, signed with Trading Technologies' own certificate — carried a backdoor. In Mandiant's words, this was "the first we are aware of which has led to a cascading software supply chain compromise." One vendor's poisoned build became the initial access vector for poisoning another vendor's build.

The forensic basis for linking the two intrusions is specific rather than circumstantial. The same RC4 key, 3jB(2bsG#@c7, and the same hardcoded cookie variable, __tutma, appear in both the X_TRADER and 3CX payloads, alongside an identical SIGFLIP and DAVESHELL loading chain. This is what makes the cascade a finding rather than an inference.

The most instructive detail, however, is the gap between distribution and exploitation. Trojanised clients reached a very large installed base, but Kaspersky — which identified a second-stage backdoor named Gopuram on victim machines — found it deployed to fewer than ten hosts, concentrated on cryptocurrency companies. The actor did not treat mass distribution as the objective. It treated it as a targeting funnel, discarding the overwhelming majority of the access it obtained.

CVE-2023-29059 carries a CVSS v3.1 base score of 7.8 (High). That score is not wrong, but it measures the wrong thing: CVSS describes the exploitability of a flaw on a host, and has no vocabulary for a validly signed artefact emerging from a compromised vendor build pipeline. This paper treats the incident as Critical on the basis of that blast radius, and the divergence is itself worth noting for anyone who triages by score alone.

Verification of Claims

Claim: Trojanised, validly code-signed 3CX DesktopApp builds were distributed to customers through Update 7. → Verified — NVD records CVE-2023-29059 as affecting Windows Electron 18.12.407 and 18.12.416, and macOS Electron 18.11.1213, 18.12.402, 18.12.407 and 18.12.416. Independently analysed and confirmed by Sophos, CrowdStrike, Volexity and Fortinet on or immediately after March 29, 2023.

Claim: The initial compromise of 3CX's network originated from a trojanised X_TRADER installer downloaded from Trading Technologies' website. → Verified — Established by Mandiant's incident response engagement and published April 20, 2023. The installer, X_TRADER_r7.17.90p608.exe, was signed with a legitimate "Trading Technologies International, Inc" certificate.

Claim: This is the first publicly documented case of one software supply chain compromise causing another. → Verified — Mandiant states it explicitly: "The identified software supply chain compromise is the first we are aware of which has led to a cascading software supply chain compromise." MITRE ATT&CK records the same characterisation for campaign C0057.

Claim: The same threat actor was responsible for both the X_TRADER and 3CX compromises. → Verified — Both payloads share the RC4 key 3jB(2bsG#@c7, the hardcoded cookie variable __tutma, the FEEDFACE shellcode marker, and the SIGFLIP/DAVESHELL execution chain.

Claim: The operation was conducted by a North Korean state-nexus actor. → Assessed, not confirmed — Four vendors describe what appears to be one cluster using four designations at four confidence levels. Mandiant tracks UNC4736 as a "suspected North Korean nexus" cluster and assesses with moderate confidence that it relates to the financially motivated AppleJeus activity previously reported by CISA. Kaspersky attributes the campaign to Lazarus with medium to high confidence, on the basis that Gopuram was found coexisting with AppleJeus malware on victim machines. CrowdStrike identifies the actor as LABYRINTH CHOLLIMA. No government or intelligence agency has issued a formal public attribution for this incident.

Claim: APT43 was involved in the operation. → Weak — Mandiant identifies shared IP infrastructure between UNC4736 and two APT43-associated clusters, UNC3782 and UNC4469, across three IP addresses. Mandiant characterises this overlap as weak, and shared hosting infrastructure does not by itself establish operational relationship.

Claim: The macOS implant deployed to 3CX's build environment was SIMPLESEA. → Superseded — Initial reporting identified the macOS backdoor as SIMPLESEA. Mandiant subsequently determined that the malware was POOLRAT, a previously known macOS backdoor. This paper uses POOLRAT throughout. The correction is noted because a substantial volume of secondary coverage still carries the original name.

Claim: Approximately 600,000 customers, or 12 million daily users, were affected. → Unverified — These are 3CX's own published figures for its customer base and user count, repeated widely in downstream reporting and in MITRE's campaign description. They describe the size of the installed base, not the number of organisations that installed a trojanised build, and no independently verified infection count was ever published. The only precise figure available is Kaspersky's: Gopuram was observed on fewer than ten machines.

Claim: CISA issued a Cybersecurity Advisory for this incident, or added CVE-2023-29059 to the Known Exploited Vulnerabilities catalog. → Partially false — CISA published an Alert, "Supply Chain Attack Against 3CXDesktopApp", on 30 March 2023. Its substance is that CISA "is aware of open-source reports" of the compromise, followed by links to 3CX's own communications and to JCDC partner analysis from CrowdStrike, SentinelOne and Broadcom. It carries no advisory identifier, contains no independent CISA assessment, and directs no action. CISA issued no joint Cybersecurity Advisory, and CVE-2023-29059 does not appear in the KEV catalog. The distinction matters because secondary coverage treats the Alert as though it were an advisory, and because an earlier revision of this paper made the opposite error and denied the Alert existed.

Timeline

Date	Actor	Event	Source
2020	Trading Technologies	X_TRADER platform discontinued; installer remains downloadable from the vendor site	Mandiant
2022-02	Google TAG	Reports www.tradingtechnologies[.]com compromised, hosting a hidden IFRAME exploiting CVE-2022-0609 (Chrome remote code execution)	Google TAG
2022	3CX employee	Downloads and installs X_TRADER_r7.17.90p608.exe on a personal computer	Mandiant
2022	UNC4736	SIGFLIP → DAVESHELL → VEILEDSIGNAL chain establishes persistence on the host	Mandiant
2022	UNC4736	3CX corporate credentials harvested; network accessed over VPN; lateral movement begins	Mandiant
2022-11	UNC4736	MITRE ATT&CK records campaign C0057 as first seen	MITRE ATT&CK
2022-12-29	UNC4736	pbxphonenetwork[.]com resolves to 89.45.67.160	Mandiant
2023-01-09	UNC4736	msedgepackageinfo[.]com resolves to 185.38.151.11	Mandiant
2022–2023	UNC4736	Windows and macOS build environments compromised; TAXHAUL, COLDCAT and POOLRAT deployed	Mandiant
2023-03-22	SentinelOne	Surge in behavioural detections against trojanised 3CX installers; customers report antivirus alerts on 3CX forums	SentinelOne
2023-03-29	CrowdStrike	Public disclosure, initially posted to Reddit before formal publication	CrowdStrike
2023-03-29	Sophos	Managed Detection and Response identifies malicious activity originating from 3CXDesktopApp	Sophos
2023-03-30	3CX	Notifies customers of the security issue affecting Update 7	3CX
2023-03-30	NIST	CVE-2023-29059 published	NVD
2023-03-30	Volexity	Publishes analysis of the ICONIC stealer stage	Volexity
2023-04-03	Kaspersky	Discloses Gopuram backdoor; attributes campaign to Lazarus with medium-to-high confidence	Securelist
2023-04-20	Mandiant	Publishes the X_TRADER cascade finding	Mandiant

A note on the timeline's precision: MITRE ATT&CK dates campaign C0057 from November 2022, while Mandiant's evidence chain — the Google TAG report of the compromised Trading Technologies site, and the employee's installation of X_TRADER — begins earlier in 2022. These are not necessarily in conflict; MITRE's window likely reflects the 3CX-directed phase specifically. The discrepancy is recorded rather than reconciled, because reconciling it would require evidence neither source provides.

Attack Anatomy

Initial Access — Drive-by Compromise of an Upstream Vendor

The entry point was not 3CX. It was Trading Technologies, whose website Google's Threat Analysis Group had already identified in February 2022 as compromised and serving a hidden IFRAME exploiting CVE-2022-0609, a remote code execution vulnerability in Chrome. TAG associated that activity with the AppleJeus cluster targeting cryptocurrency services.

The X_TRADER platform had been discontinued in 2020, yet the installer remained available for download from the vendor's site into 2022 — an abandoned distribution channel still trusted by its users and, evidently, still maintained by no one.

A 3CX employee downloaded that installer onto a personal computer. The machine held credentials for 3CX's corporate environment.

MITRE ATT&CK: T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution)

Execution — Signature-Preserving Code Injection

The trojanised Setup.exe dropped two malicious DLLs and one benign executable, which then side-loaded the malicious code. The loading chain is worth describing precisely, because it defeats the control most organisations rely on to answer "is this binary trustworthy."

SIGFLIP patches authenticode-signed PE-COFF files to inject code without invalidating the digital signature. It does this by abusing CVE-2013-3900, the WinVerifyTrust signature validation vulnerability addressed by MS13-098 — a flaw for which Microsoft shipped a fix in 2013 but left disabled by default, on compatibility grounds, for the following decade. The injected data is located via the byte marker FEEDFACE and decrypted with an RC4 stream cipher keyed on 3jB(2bsG#@c7.

The decrypted payload is DAVESHELL, a shellcode-based in-memory loader that converts PE-COFF files into position-independent code and reflectively loads them, leaving no file on disk for a scanner to inspect. DAVESHELL extracts and executes VEILEDSIGNAL.

VEILEDSIGNAL is a modular C/C++ backdoor supporting three commands: transmit implant data, execute shellcode, and terminate. It encrypts communications with AES-256 GCM, injects a dedicated C2 module into Chrome, Firefox or Edge so that its network traffic originates from a browser process, and coordinates its modules over Windows named pipes. Its C2 endpoint was www.tradingtechnologies[.]com/trading/order-management — the compromised vendor's own domain, which would appear unremarkable in the network logs of anyone who used the product.

MITRE ATT&CK: T1553.002 (Code Signing), T1027.013 (Encrypted/Encoded File), T1620 (Reflective Code Loading), T1055.002 (Portable Executable Injection), T1559 (Inter-Process Communication)

Lateral Movement — Valid Credentials and Masquerading Tools

With the employee's machine under control, the actor obtained 3CX administrator credentials and used them to authenticate to the corporate network over VPN. No exploit was required at this stage; the access was legitimate by every technical measure available to 3CX.

For lateral movement the actor deployed Fast Reverse Proxy, an open-source tunnelling utility, written to C:\Windows\System32 under the filename MsMpEng.exe — the name of the Microsoft Defender Antimalware Service executable. A defensive tool's name on an offensive tool's binary, in the directory where the real one would plausibly live.

MITRE ATT&CK: T1078 (Valid Accounts)

Build System Compromise — The Pivot That Matters

Everything to this point is a competent intrusion. What follows is the part that turns an intrusion into a supply chain attack: the actor compromised the build environments for both the Windows and macOS products.

On the Windows build server, the actor installed TAXHAUL, a DLL launcher that decrypts its shellcode payload from C:\Windows\System32\config\TxR\<machine hardware profile GUID>.TxR.0.regtrans-ms — a transaction log path belonging to the Windows registry's transactional subsystem, unlikely to attract scrutiny. TAXHAUL persisted through DLL search-order hijacking of the IKEEXT service and executed with LocalSystem privileges. Alongside it ran COLDCAT, a downloader that generated a unique host identifier and beaconed to its C2 over HTTPS with data encoded in the cookie header, expecting base64-encoded shellcode in the response.

On the macOS build server, the actor deployed POOLRAT, a C/C++ backdoor capable of collecting system information, executing arbitrary commands, reading and writing files, securely deleting files, and updating its own configuration. It persisted via a Launch Daemon.

MITRE ATT&CK: T1574.001 (DLL Hijacking), T1543.004 (Launch Daemon), T1071.001 (Web Protocols)

Distribution — Trojanised Clients Through Legitimate Channels

With both build environments under control, malicious code was injected into the products themselves. On Windows, the trojanised ffmpeg.dll shipped inside the Electron application located and decrypted a payload embedded in d3dcompiler_47.dll. On macOS, a malicious .dylib was added to the .dmg installer.

The resulting artefacts were signed by 3CX, distributed by 3CX, and delivered through 3CX's update mechanism. Every integrity control available to the customer returned a positive result, because every one of those controls verifies that software came from the vendor — and it had.

MITRE ATT&CK: T1218.015 (Electron Applications), T1546.016 (Installer Packages), T1195.002 (Software Supply Chain Compromise)

Command and Control — Dead Drop Resolver and Delayed Execution

The first-stage downloader in the 3CX client, SUDDENICON, did not contain its C2 addresses. It retrieved them from encrypted data appended to icon files hosted in a GitHub repository at raw.githubusercontent[.]com/IconStorages/images/main/. Traffic to GitHub's raw content domain is ordinary in almost any corporate environment, and the payload was carried inside valid image files.

Execution was then deferred by a randomly selected interval of one to four weeks. This defeats sandbox analysis, which will not wait, and — more importantly against human defenders — decouples the installation event from the malicious activity in the logs. By the time anything happened, the software installation that caused it was weeks in the past and no longer an obvious candidate during triage.

The final stage was ICONICSTEALER, a data miner collecting application configuration data and browser history.

MITRE ATT&CK: T1102.001 (Dead Drop Resolver), T1678 (Delay Execution), T1217 (Browser Information Discovery)

Objective — Selective Second-Stage Deployment

Kaspersky's analysis identified a further backdoor, Gopuram, which it had tracked internally since 2020 and whose infections began rising in March 2023. Gopuram connects to a C2 server and awaits instructions, supporting file system interaction, process creation, and the execution of up to eight in-memory modules.

It was deployed to fewer than ten machines, concentrated on cryptocurrency companies. On those machines it coexisted with AppleJeus malware — the observation on which Kaspersky based its attribution to Lazarus.

Threat Actor Profile

The most accurate description of the actor behind this campaign is that four capable vendors examined the same evidence and produced four designations at four confidence levels, none of which has been ratified by any government.

Source	Designation	Stated confidence
Mandiant	UNC4736	Suspected North Korean nexus
Mandiant	Relationship to AppleJeus	Moderate confidence
Mandiant	Overlap with APT43 (UNC3782, UNC4469)	Weak
Kaspersky	Lazarus	Medium to high confidence
CrowdStrike	LABYRINTH CHOLLIMA	Suspected nation-state
MITRE ATT&CK	AppleJeus (G1049), campaign C0057	—

Mandiant's link to AppleJeus rests on a concrete artefact: an older POOLRAT sample previously reported by CISA in a trojanised CoinGoTrade application, whose infrastructure ties to JMT Trading — both tracked under the AppleJeus umbrella. The POOLRAT deployed in the 3CX intrusion used journalide[.]org for command and control.

The APT43 connection is weaker and Mandiant says so. Three IP addresses hosted domains belonging to both UNC4736 and the APT43-associated clusters UNC3782 and UNC4469, with resolutions separated by weeks or months. Shared hosting among North Korean clusters is common and does not establish that the same operators were involved.

The operational profile is consistent across sources: financially motivated, focused on cryptocurrency, and willing to invest in long-horizon access. That profile is characteristic of North Korean activity, which is the basis on which each vendor reached its assessment. It is not the same thing as confirmation, and this paper does not present it as such.

Technical Indicators

All indicators are defanged. Hashes are MD5, as published by Mandiant.

Malware and tooling
  X_TRADER installer      ef4ab22e565684424b4142b1294f1f4d
  SigLoader / SIGFLIP     a3ccc48db9eabfed7245ad6e3a5b203f
  DAVESHELL               8a34adda5b981498234be921f86dfb27
  VEILEDSIGNAL            c6441c961dcad0fe127514a918eaabd4
  VEILEDSIGNAL            404b09def6054a281b41d309d809a428
    injection module      6727284586ecf528240be21bb6e97f88
    C2 module             00a43d64f9b5187a1e1f922b99b09b77
  TAXHAUL                 e424f4e52d21c3da1b08394b42bc0829
  POOLRAT (CoinGoTrade)   451c23709ecd5a8461ad060f6346930c
  Fast Reverse Proxy      19dbffec4e359a198daf4ffca1ab9165
  3CX MSI installer       0eeb1c0133eb4d571178b2d9d14ce3e9
  3CX MSI installer       f3d4144860ca10ba60f7ef4d176cc736
  3CXDesktopApp           74bc2d0b6680faa1a5a76b27e5479cbc
  3CXDesktopApp           7faea2b01796b80d180399040bb69835

Network infrastructure
  www.tradingtechnologies[.]com/trading/order-management   VEILEDSIGNAL C2
  raw.githubusercontent[.]com/IconStorages/images/main/    SUDDENICON dead drop
  journalide[.]org                                          POOLRAT C2
  pbxphonenetwork[.]com                                     UNC4736
  msedgepackageinfo[.]com                                   UNC4736
  89.45.67[.]160                                            shared hosting
  172.93.201[.]88                                           shared hosting
  185.38.151[.]11                                           shared hosting

Host artefacts and strings
  RC4 key                 3jB(2bsG#@c7
  Cookie variable         __tutma
  Shellcode marker        FEEDFACE
  Signing certificate     Trading Technologies International, Inc
  TAXHAUL payload path    C:\Windows\System32\config\TxR\<GUID>.TxR.0.regtrans-ms
  Masquerading binary     MsMpEng.exe in C:\Windows\System32
  Persistence (Windows)   IKEEXT service DLL search-order hijack
  Persistence (macOS)     Launch Daemon
  Sideloading chain       ffmpeg.dll → d3dcompiler_47.dll

Legal and Regulatory Response

The defining feature of the response to this incident is how little of it was governmental.

Government directives. CISA published an Alert on 30 March 2023, "Supply Chain Attack Against 3CXDesktopApp," relaying open-source reporting and linking to 3CX's communications and to JCDC partner analysis. It carried no advisory identifier, contained no independent CISA assessment, and required no action of anyone. No joint Cybersecurity Advisory followed. CVE-2023-29059 was not added to the Known Exploited Vulnerabilities catalog, and consequently no binding operational directive required United States federal agencies to remediate it within a fixed window — despite the CVE record itself stating that the code was "exploited in the wild in March 2023." The federal contribution was an awareness notice pointing at private-sector reporting, which is a materially weaker instrument than an advisory carrying its own analysis.

Law enforcement actions. No arrests, indictments or criminal charges have been publicly connected to this incident.

Sanctions. No sanctions designation names this compromise, either of individuals or entities. Broader sanctions programmes targeting North Korean cyber and cryptocurrency activity exist, but no public instrument links them to the 3CX or X_TRADER compromises, and this paper does not assert a connection that the record does not support.

Platform response. GitHub removed the repository hosting the icon files used as the dead drop resolver. Trading Technologies' compromised website was remediated following Google TAG's 2022 reporting, though the trojanised X_TRADER installer remained available for download afterwards.

Vendor response. 3CX engaged Mandiant to conduct the investigation, published incident updates including Mandiant's findings, and directed customers away from the compromised desktop client — ultimately recommending its Progressive Web App in place of the Electron application.

The analytical point deserves stating plainly: an attack that compromised the build systems of a vendor with a very large installed base, distributed signed malicious software to its customers, and was attributed by four commercial vendors to a suspected state actor, produced no advisory, no directive, no indictment and no sanction. The entire effective response came from private-sector detection and one vendor's own incident response engagement. Whatever conclusion one draws from that, it is a materially different regulatory posture from the one applied to comparable incidents affecting government supply chains.

Impact Assessment

The distribution–exploitation gap. The clearest lesson of this incident is the asymmetry between how many systems the actor could have exploited and how many it did. Trojanised, signed clients reached a large installed base; confirmed second-stage deployment reached fewer than ten machines. Mass compromise was the delivery mechanism, not the goal. For defenders, this inverts a common assumption: the absence of observable malicious activity after installing a compromised build is not evidence that the build was clean, or that the organisation was not selected — only that it was not selected yet, given a dwell period the actor deliberately extended by one to four weeks.

Code signing as an integrity control. The incident demonstrates two independent failures of signature-based trust. The X_TRADER installer was validly signed by Trading Technologies; the 3CX clients were validly signed by 3CX. In both cases the signature was truthful — the software genuinely came from the named vendor — and in both cases it was worthless as an integrity guarantee, because the vendor's build environment was under adversary control. SIGFLIP's abuse of CVE-2013-3900 compounds this: signed binaries could be modified without invalidating the signature at all.

Electron and client attack surface. 3CX's remediation guidance — moving customers to a Progressive Web App — functions as an implicit assessment of the desktop client's attack surface. An Electron application ships a browser runtime and a set of native DLLs, several of which are attractive sideloading targets. ffmpeg.dll was one.

The unwitting upstream. Trading Technologies was not the target. Its discontinued, still-downloadable product became the delivery vehicle for an attack on a different company's customers. Any vendor maintaining a public download for a deprecated product carries this exposure, and the fact that the product had been discontinued in 2020 made it more dangerous rather than less: nobody was watching it.

Lessons and Defensive Recommendations

For Security Teams and SOC Analysts

Correlate software installation events with activity weeks later, not hours later. The one-to-four-week execution delay was engineered specifically to break the temporal link that triage depends on; a detection process that looks backwards only as far as the previous few days will not find the cause.

Alert on legitimate tool names in illegitimate locations. MsMpEng.exe outside its expected Defender path is a high-fidelity signal, and the same reasoning generalises to any binary borrowing a system executable's name.

Treat outbound requests to raw.githubusercontent.com from hosts with no developer function as worth investigating. Dead drop resolvers work precisely because the destination is reputable; the anomaly is the source, not the destination.

Where possible, monitor for anomalous entropy or appended data in image files retrieved over the network. The C2 addresses were carried inside functioning icons.

For Developers and Architects

Code signing proves provenance, not integrity. A signature answers "did this come from the vendor," and this incident is a demonstration that the answer can be yes while the artefact is malicious. Verification strategies that terminate at a valid signature have no remaining control once a build environment is compromised.

Ensure the CVE-2013-3900 hardening is actually enabled. Microsoft's fix for the WinVerifyTrust flaw has existed since 2013 but requires explicit registry configuration; without it, signed binaries can be modified without breaking signature validation.

Treat build systems as production infrastructure. They held LocalSystem access, ran a service vulnerable to DLL search-order hijacking, and produced signed artefacts. Isolation, reproducible builds and artefact attestation are the controls that would have made the injected code detectable downstream.

For Platform and Cloud Providers

Content-hosting platforms are attractive dead drop infrastructure because the reputational cost of blocking them is high and the traffic is indistinguishable from legitimate use. Detection of anomalous binary content within media files, and responsive abuse handling, are the meaningful mitigations available at the platform layer.

Deprecated software distribution deserves an end-of-life process. An installer left downloadable three years after the product was discontinued is unmonitored infrastructure carrying the vendor's signature and reputation.

For Leadership and CISOs

Your vendor's vendor is your vendor. Third-party risk assessment that terminates at direct suppliers does not model this attack, because 3CX's exposure came through a product it had no commercial relationship with — installed by an employee, on a personal machine, for personal use.

Personal devices holding corporate credentials are supply chain attack surface. The initial foothold was not a corporate endpoint and would not have appeared in any asset inventory. Where BYOD is permitted, credential exposure on unmanaged devices is the risk being accepted, whether or not it has been articulated that way.

Finally, calibrate expectations about external response. This incident generated no advisory, no directive and no enforcement action. Organisations depending on government notification as a component of their detection strategy should note how much of the useful information here came from commercial vendors, and how quickly — within days of disclosure — compared to what never arrived at all.

Sources

• Mandiant — 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible
• MITRE ATT&CK — 3CX Supply Chain Attack, Campaign C0057
• NVD — CVE-2023-29059
• CISA — Alert: Supply Chain Attack Against 3CXDesktopApp
• CISA — Known Exploited Vulnerabilities Catalog
• Kaspersky Securelist — Not just an infostealer: Gopuram backdoor deployed through the 3CX supply chain attack
• Sophos — 3CX DLL sideloading attack
• CrowdStrike — CrowdStrike detects and prevents active intrusion campaign targeting 3CXDesktopApp customers
• Volexity — 3CX supply chain compromise leads to ICONIC incident
• Fortinet FortiGuard Labs — 3CX Desktop App compromised (CVE-2023-29059)
• 3CX — DesktopApp security alert
• Microsoft — MS13-098: Vulnerability in Windows could allow remote code execution (CVE-2013-3900)

---

Corrections log — 2 September 2026: This paper originally stated that no CISA advisory was issued for the 3CX compromise, and rated the claim that one existed as False. That was wrong. CISA published an Alert, "Supply Chain Attack Against 3CXDesktopApp", on 30 March 2023. The Alert relays open-source reporting and links to vendor analysis; it carries no advisory identifier, contains no CISA assessment, and directs no action — but it exists, and describing it as absent overstated the case. The claim is now rated Partially false, and the Legal and Regulatory Response section has been rewritten to distinguish an awareness Alert from a Cybersecurity Advisory. The separate finding that CVE-2023-29059 is not in the Known Exploited Vulnerabilities catalog was verified against the catalog feed and is unchanged.