Quick Answer — In late March 2023, researchers discovered that 3CX’s desktop VoIP client — legitimately code-signed by 3CX — carried a trojan in its updater: the official build pipeline had been compromised, shipping info-stealer behavior inside a trusted business app used by hundreds of thousands of organizations. CrowdStrike’s assessment traced the initial compromise of 3CX to an upstream software vendor’s tainted build, making it the first publicly documented “double supply-chain attack”. The lesson: a valid signature proves build integrity only as far back as the build machine — and dependency trees are recursive attack surface.
What happened
- The discovery: On March 29, 2023, multiple AV/EDR vendors flagged 3CXDesktopApp’s Windows and macOS builds for beaconing to odd infrastructure; 3CX initially misjudged it as false positives — a most instructive 24 hours in vendor-response history.
- The mechanism: The app’s updater was trojanized at build time: the shipped binary — signed with 3CX’s legitimate certificate — loaded a stager that fetched further payloads selectively by victim profile.
- The double-chain: Per CrowdStrike, 3CX’s build environment was compromised via a trojanized build of a financial-trading software package installed on build machines — attackers first compromised that trading software vendor, then rode the second hop into 3CX. Attribution lanes pointed toward Lazarus-adjacent (DPRK-nexus) operations, with the Gopuram backdoor deployed on a select subset of high-value victims.
- The selectivity: Most infected orgs got info-stealer behavior; a chosen few — crypto-focused firms among them — received deeper implants. Wide base, narrow depth.
Why signed malware is a category shift
| Legacy assumption | What 3CX proved |
|---|---|
| Signed binary = vendor-authored | Signature validates the key, not the cleanliness of the build inputs |
| Vendor builds from clean source | Build machines are endpoints too — with browsers, and employees who install software |
| Upstream deps are inert libraries | A dependency’s installer can be the payload; you inherit your vendors’ hygiene |
| One hop of verification is enough | Attestation must run to the root of the build graph or it’s theater |
The attack chain (per CrowdStrike and vendor reporting)
- Hop one: Compromise of an upstream trading-software vendor; its product shipped a first-stage implant.
- Hop two: A 3CX employee/dev installed the trading app on build infrastructure; the implant enumerated the environment and gained a foothold in the build pipeline.
- Payload weave: Trojanized updater in official signed builds; ICO-file-embedded stagers; mutable C2 via attacker-controlled infrastructure pools.
- Crown jewel: Gopuram backdoor on hand-picked victims — consistent with espionage-plus-revenue DPRK dual-track operations.
Timeline
| Date | Event |
|---|---|
| ~2022 (per reporting) | Upstream trading-software vendor compromised — patient zero of the double chain |
| 2023-03-22 → 29 | Trojanized 3CX builds propagate; EDR flags accumulate; researchers publish |
| 2023-03-29 → 30 | 3CX’s initial “false positive” stance revisited; incident escalated; clean builds promised |
| 2023-04 | CrowdStrike details Lazarus attribution + Gopuram subset; Google TAG ties infrastructure |
| 2023 → 2024 | 3CX rebuilds, rotates certs; case becomes the canonical SLSA/SBOM talking point |
Defensive lessons
- Build environments are production crown jewels. They browse, they install, they trust — so they get owned. Treat build infra to the same zero-trust standard as domain controllers.
- Chain attestations the way you chain trust. SLSA provenance, hermetic builds, and SBOMs matter precisely because each hop of your dependency graph can be someone else’s endpoint.
- Signatures are necessary, never sufficient. Detach the mental model: the cert says “this exact binary left this key” — everything upstream of the key is unverified.
- Baseline your vendor binaries’ behavior. Orgs that flagged 3CX first watched network behavior of signed apps — beacon patterns — not signature status.
- Prepare for the false-positive wars. The scariest 24 hours were social, not technical: every security team had to overrule a vendor’s “our binary is fine” against their own telemetry. Pre-agree how that tie breaks.
Why it still matters in 2026
The 3CX incident reset the industry’s mental model of transitive trust: security programs that had spent a decade on their own SDLC suddenly had to ask what their vendors’ build machines ran, and what their vendors’ vendors ran before that. In 2026’s landscape — with SBOM mandates matured, SLSA-style provenance in enterprise procurement language, and attacker interest in build infra unabated (XZ Utils’ near-miss proved the class endures) — the 3CX double-chain remains the reference diagram: two hops, two signatures, one implant. The countermeasure stack is boring and public; the gap is that most of the ecosystem still hasn’t built it.
How did most victims actually experience it?
As an EDR alert storm about a signed, business-essential app — followed by an uncomfortable triage: is our VoIP client spying, and can we afford to remove it? Many orgs quarantined by firewalling the C2 rather than uninstalling, buying time for clean builds. The operational friction of “trusted app gone hostile” was itself the discovery: few IR playbooks had a page for that.
Why did attribution say North Korea?
Per CrowdStrike and subsequent vendor corroboration: code lineage overlapping known Lazarus tooling, the Gopuram backdoor matching prior DPRK-nexus operations, infrastructure reuse with earlier crypto-theft campaigns, and the victim-selection pattern favoring crypto companies — fitting a group that funds state operations through theft. Attribution remained probabilistic consensus, not courtroom fact, as always in this domain.
What should orgs have done on March 29, 2023?
Treat the app as hostile without uninstalling the business: block the known C2 at egress, hunt for the stager’s artifacts fleet-wide, rotate credentials that passed through the app’s host machines, and demand build provenance from the vendor before reinstalling. The orgs that treated “signed by vendor” as satisficing did all of it a week late.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
