← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Supply Chain Compromise Campaign Targeting 3CXDesktopApp Customers
WHITE tr2222200 2023-04-04 Modified: 2023-04-04
277
IOCs
HIGH VOLUME
3CXDesktopAppSupply Chain Compromise
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (44 / 277 total)
All domain FileHash-SHA1 FileHash-MD5 FileHash-SHA256 URL email
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA1 3b88cda62cdd918b62ef5aa8c5a73a46f176d18b — 2023-04-04
FileHash-SHA1 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea — 2023-04-04
FileHash-SHA1 8433a94aedb6380ac8d4610af643fb0e5220c5cb — 2023-04-04
FileHash-SHA1 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa — 2023-04-04
FileHash-SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e — 2023-04-04
FileHash-SHA1 20d554a80d759c50d6537dd7097fed84dd258b3e — 2023-04-04
FileHash-SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 — 2023-04-04
FileHash-SHA1 cad1120d91b812acafef7175f949dd1b09c6c21a — 2023-04-04
FileHash-SHA1 188754814b37927badc988b45b7c7f7d6b4c8dd3 SHA1 of c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 2023-04-04
FileHash-SHA1 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa SHA1 of aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 2023-04-04
FileHash-SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e SHA1 of 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 2023-04-04
FileHash-SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 — 2023-04-04
FileHash-SHA1 769383fc65d1386dd141c960c9970114547da0c2 — 2023-04-04
FileHash-SHA1 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa SHA1 of aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 2023-04-04
FileHash-SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e SHA1 of 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 2023-04-04
FileHash-SHA1 e272715737b51c01dc2bed0f0aee2bf6feef25f1 SHA1 of 5d99efa36f34aa6b43cd81e77544961c5c8d692c96059fef92c2df2624550734 2023-04-04
FileHash-SHA1 19f4036f5cd91c5fc411afc4359e32f90caddaac — 2023-04-04
FileHash-SHA1 20d554a80d759c50d6537dd7097fed84dd258b3e — 2023-04-04
FileHash-SHA1 3b3e778b647371262120a523eb873c20bb82beaf — 2023-04-04
FileHash-SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 — 2023-04-04
FileHash-SHA1 413d9cbfcbf8d1e8304eab0aa5484f5eec5185f5 — 2023-04-04
FileHash-SHA1 480dc408ef50be69ebcf84b95750f7e93a8a1859 — 2023-04-04
FileHash-SHA1 5d833bcc679db38a45111269e727ec58b75c8d31 — 2023-04-04
FileHash-SHA1 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea — 2023-04-04
FileHash-SHA1 769383fc65d1386dd141c960c9970114547da0c2 — 2023-04-04
FileHash-SHA1 8433a94aedb6380ac8d4610af643fb0e5220c5cb — 2023-04-04
FileHash-SHA1 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa — 2023-04-04
FileHash-SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 — 2023-04-04
FileHash-SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e — 2023-04-04
FileHash-SHA1 f3487a1324f4c11b35504751a5527bc60eb95382 — 2023-04-04
FileHash-SHA1 19f4036f5cd91c5fc411afc4359e32f90caddaac — 2023-04-04
FileHash-SHA1 20d554a80d759c50d6537dd7097fed84dd258b3e — 2023-04-04
FileHash-SHA1 3b3e778b647371262120a523eb873c20bb82beaf — 2023-04-04
FileHash-SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 — 2023-04-04
FileHash-SHA1 413d9cbfcbf8d1e8304eab0aa5484f5eec5185f5 — 2023-04-04
FileHash-SHA1 480dc408ef50be69ebcf84b95750f7e93a8a1859 — 2023-04-04
FileHash-SHA1 5d833bcc679db38a45111269e727ec58b75c8d31 — 2023-04-04
FileHash-SHA1 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea — 2023-04-04
FileHash-SHA1 769383fc65d1386dd141c960c9970114547da0c2 — 2023-04-04
FileHash-SHA1 8433a94aedb6380ac8d4610af643fb0e5220c5cb — 2023-04-04
FileHash-SHA1 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa — 2023-04-04
FileHash-SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 — 2023-04-04
FileHash-SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e — 2023-04-04
FileHash-SHA1 f3487a1324f4c11b35504751a5527bc60eb95382 — 2023-04-04
References (7)
↗ https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/ ↗ https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack/ ↗ https://objective-see.org/blog/blog_0x73.html ↗ https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/ ↗ https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats ↗ https://www.3cx.com/blog/news/desktopapp-security-alert/ ↗ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trustwave-action-response-supply-chain-attack-using-3cx-pbax-software/