In March 2023, signed 3CX Desktop App builds were found to contain malware. Mandiant later traced the breach to a trojanized installer of another company's discontinued software, the first time it had seen one supply chain attack lead to another. Defenders should learn about build security and software inventory.
This post uses a small set of public sources and says where they differ. It does not name anything that those sources do not support.
What was 3CX Desktop App?
Mandiant describes it as enterprise software providing chat, video and voice calls. The compromised builds were signed, which is why many security tools initially trusted them.
Timeline from public sources
- Early 2022: Mandiant cites Google's Threat Analysis Group reporting that the website of Trading Technologies was compromised in February 2022 and hosted a hidden frame to exploit visitors, about two months before it delivered a trojanized X_TRADER package.
- 2022: Mandiant says X_TRADER, reportedly discontinued in 2020, was still available for download from the legitimate Trading Technologies website. The installer was signed with that company's certificate, which was set to expire in October 2022.
- Late March 2023: trojanized 3CX Desktop App builds spread malware. Mandiant says versions 18.12.416 and earlier contained malicious code. New Zealand's National Cyber Security Centre lists affected Windows versions as 18.12.407 and 18.12.416, and Mac versions as 18.11.1213, 18.12.402, 18.12.407 and 18.12.416.
- 31 March 2023: the NCSC advisory encouraged organizations to uninstall the affected app, check published indicators of compromise, and look for malicious activity. It noted 3CX's recommendation to use its web-based PWA client instead.
- April 2023: 3CX shared Mandiant's interim assessment attributing the activity to a cluster Mandiant tracks as UNC4736, with a North Korea nexus.
- 20 April 2023: Mandiant published its finding that the initial compromise of the 3CX network came through malicious software downloaded from the Trading Technologies website.
What did the malware do?
Per Mandiant, the 3CX app contained a downloader that fetched command-and-control addresses from encrypted icon files hosted on GitHub, then a third stage described as a data miner that steals browser information. The NCSC advisory adds reports from other vendors: Huntress observed a seven day delay before the app contacted external servers, and Volexity reported collection of system information and browser history from several browsers.
How did the attackers get into 3CX?
Mandiant reports a malware-laced X_TRADER installer, which ran a loading chain that deployed a modular backdoor. From there the attacker harvested credentials and moved laterally, using a public reverse proxy tool. Mandiant says both the Windows and macOS build environments were compromised, which is what let the attacker put malicious code into signed releases.
What do the sources disagree on?
Trading Technologies told reporters it could not verify Mandiant's assertions at the time, said 3CX is neither a vendor nor a customer of the company, and said X_TRADER was retired in April 2020. Mandiant's reported finding is that the 3CX network was compromised through the trojanized X_TRADER installer, and that the software was still downloadable in 2022. Read both statements, and treat attribution to a state-linked actor as an assessment, not a court finding. Mandiant itself states moderate confidence on some of its links.
Five lessons for defenders
These are our reading of the sources, not statements from them.
- Inventory what runs, including retired software. An employee installing an old trading application started the chain. You cannot remove what you do not know is installed.
- Protect the build. If a build system is compromised, the output is signed and trusted. Separate build credentials, restrict who and what can reach build servers, and monitor them like production.
- A signature proves who signed, not that the code is safe. Detection on behavior, such as a signed app beaconing to unusual hosts, is the backstop.
- Plan the vendor advisory drill. When a supplier tells you to uninstall, how fast can you find every copy? The NCSC guidance came with a fallback client. Know your fallback before you need it.
- Retire and unpublish. Discontinued software left on a download page was part of this story.
What to do
- Ask endpoint management for a list of every installed version of your communications and business software, and compare it with your approved list.
- Review who can authenticate to build systems and how they connect. Remove standing access.
- Add detections for trusted binaries making new outbound connections.
- Write a one page runbook for "supplier says uninstall now," including who decides and how you verify removal.
- Check your own download pages for retired products and remove them.
Quick check
Was the 3CX compromise caused by a vulnerability in a library?
According to Mandiant, no. It came from a malicious installer of another company's software, which then led to compromise of 3CX build environments.
Does a valid code signature mean a download is safe?
No. In this case the malicious installers and the 3CX builds were signed. The signature shows the signer, not the intent of the code.
Sources
- Mandiant, 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise
- New Zealand NCSC, Supply Chain Attack against 3CXDesktopApp
- The Record, 3CX supply chain attack began with another supply chain attack
Last reviewed: 18 October 2026.
