The 3CX compromise spread through trojanized software from a trusted vendor, and Mandiant later traced it to an earlier compromise at a second vendor. Use this checklist to test whether your organization would notice the same steps: retired software, signed binaries, DLL side-loading, build environments and unusual outbound connections.
What happened, in short?
In March 2023, a trojanized version of the 3CX Desktop App spread malware to users who downloaded it from the vendor's website. CISA published an alert on 30 March 2023 asking organizations to review vendor and partner reports and hunt for indicators of compromise. Mandiant's later investigation found the 3CX network was first compromised through malicious software downloaded from the Trading Technologies website: a tampered installer for X_TRADER. Mandiant said it was the first time it had seen a software supply chain attack lead to another.
Mandiant reported that X_TRADER had reportedly been discontinued in 2020 but was still downloadable in 2022. The installer was signed with a certificate belonging to the vendor, and the signing certificate was set to expire in October 2022. The attackers then moved through 3CX's network with credential harvesting and lateral movement and compromised both the Windows and macOS build environments.
Neither company was careless in a way that excuses the attackers. Capable actors chained two vendors. The point of the checklist is to ask what would have given you a chance.
What can you check today?
Work through these as questions for your own team. A "no" means a gap, not a failure.
1. Do we know what retired software still exists? The first link was a discontinued product still available for download. Ask whether you track end-of-life software on endpoints, and whether staff can still obtain installers for products you no longer approve.
2. Do we treat a valid signature as proof of safety? The malicious installer carried a legitimate signature. Signatures prove who signed, not that the content is wanted. Test whether your controls look at behavior after install, not only at the signature check.
3. Would we detect DLL side-loading? Mandiant describes a signed, benign executable loading a malicious DLL disguised as a dependency. Ask whether endpoint tooling flags a trusted program loading an unexpected library from its own folder.
4. Do our build systems have the same protection as production? The attackers reached Windows and macOS build environments. Check credential hygiene, segmentation, monitoring and patching on build hosts, and how you would know if a build output changed.
5. Can we see unusual outbound traffic from ordinary apps? Mandiant describes the first stage fetching encrypted icon files from a code hosting site to learn where to connect next. Ask whether you baseline outbound destinations for communication software, and whether traffic to code hosting sites from a desktop phone app would stand out.
6. Do we detect lateral movement tools? The attackers used a compiled public reverse proxy tool, dropped into the Windows system directory. Ask whether you would alert on unexpected binaries in system directories.
7. Can we ingest vendor and government alerts and hunt quickly? CISA's alert pointed to vendor communications and partner analyses. Practice taking indicators from an alert and searching your estate within hours.
8. Can we remove or roll back a vendor product fast? CISA's alert linked vendor instructions for uninstalling the desktop app. Test whether you can find every install and remove it, and who decides.
9. Do we know our vendors' vendors? The chain ran through a second supplier. Ask critical vendors how they control their own software inputs and how they would tell you.
What to do
- Run a table-top using these nine questions and score each one yes, partly or no.
- Maintain an inventory that includes end-of-life software and remove installers you no longer approve.
- Add behavioral detection for signed binaries that load unexpected libraries.
- Harden build hosts and monitor build output integrity.
- Baseline outbound traffic for business applications and alert on new destinations.
- Write a runbook for taking an alert's indicators and searching all endpoints.
- Keep a tested method to uninstall a product across the fleet.
- Add supplier software-control questions to your vendor reviews.
Quick check
Would a software bill of materials have caught 3CX?
Not by itself. The compromise sat inside a vendor's signed software. An inventory helps you find affected installs fast once an alert appears, which is the response step.
Does a valid code signature mean software is safe?
No. Mandiant reported the malicious X_TRADER installer was signed with the vendor's certificate. A signature shows who signed it, not that the contents are benign.
Sources
- Mandiant, 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise
- CISA, Supply Chain Attack Against 3CXDesktopApp
Last reviewed: 18 October 2026.
