Attackers first compromised a different software company, Trading Technologies. A tampered installer for its discontinued X_TRADER app reached a 3CX employee. From there, per Mandiant, the attackers reached 3CX's build environments and shipped a trojanized 3CX DesktopApp to customers in late March 2023.
What happened, in order?
Mandiant's April 20, 2023 write-up describes three stages.
Stage one. The Trading Technologies website was compromised in February 2022, according to Google's Threat Analysis Group. An installer for X_TRADER, a product reportedly discontinued in 2020, stayed available. It was signed with a legitimate certificate belonging to Trading Technologies, set to expire in October 2022.
Stage two. Mandiant found that 3CX's network was first breached through that malicious X_TRADER download. The attacker moved sideways, harvested credentials and compromised the Windows and macOS build environments.
Stage three. A trojanized 3CX DesktopApp, versions 18.12.416 and earlier per Mandiant, was distributed from 3CX's own channels. The app's downloader fetched later stages, and a data stealer targeted browser information.
Mandiant wrote that this was the first time it had seen one software supply chain attack lead to another. It tracked the actor as UNC4736 and assessed it as a suspected North Korean group, with moderate confidence in a link to earlier AppleJeus activity.
Why was it hard to spot?
The final payload rode inside a signed, legitimate product that customers had good reason to trust. The first link was a signed installer for software nobody was meant to be using anymore. Neither looked like malware to a user or to a basic allow list.
What does it teach a software vendor?
Your build environment is a target in its own right, and your employees install other vendors' software. Two separate controls matter here.
First, retire old software properly. A discontinued installer that stays downloadable with a valid signature is a liability for years.
Second, treat build machines as production. Separate them from general corporate use, limit which software can run on them, and watch for credential harvesting.
What does it teach a customer?
You cannot verify what you cannot enumerate. When the news broke, the first question was "do we run 3CX, and which version." Teams with an inventory answered in minutes. Teams without one searched endpoints by hand.
A constructed example
A logistics firm pushes a desktop client update to 4,000 laptops on a Tuesday. On Thursday a vendor advisory names the version. The firm's software inventory shows 3,100 machines on the bad build, which version rolled where, and which group already had the client blocked by a network rule. The decision to isolate and reimage takes an hour, not a week.
How to check or apply this
- Keep an inventory of installed software by version, refreshed automatically, for endpoints and servers.
- Generate an SBOM for every product you ship, so your customers can answer the same question about you.
- Remove or revoke old installers, and retire signing certificates you no longer need.
- Isolate build systems, and require review and logging for changes to build scripts.
- Plan for vendor compromise: know how you would block a vendor's update channel and where its credentials live.
- When an advisory lands, search by version, hunt for the published indicators and review outbound connections from affected hosts.
Safeguard can generate SBOMs and scan dependencies for the products you build, which covers the "what is inside" half of this problem. It does not replace endpoint tooling.
What should you not conclude?
Do not conclude that signed software is untrustworthy by default, or that 3CX customers were careless. The attackers abused trust that most vendors and customers share. Do not repeat attribution as fact either: Mandiant labels it an assessment. The sound conclusion is narrower. Trust in a signature must be backed by controls on who can sign and what the build produced, and customers need their own inventory.
Quick check
Was the 3CX app signed?
Mandiant describes the X_TRADER installer as signed with Trading Technologies' certificate. A valid signature shows who signed a file, not that the file is safe.
Who was behind it?
Mandiant assessed UNC4736 as a suspected North Korean actor, with moderate confidence in a link to AppleJeus activity. Attribution is an assessment, not a court finding.
Sources
Last reviewed: 18 October 2026.
