3CX Backdoor (Windows)
Aliases: SUDDENICON
- First seen
- 2023-03-29 00:00:00
- Malware type
- backdoor
- Last IoC activity
- 2026-05-01 20:32:15
- Profile updated
- 2026-07-07 13:06:16
Targeted industries: technology-and-telecommunications government-and-public-sector
Context
According to CrowdStrike, this backdoor was discovered being embedded in a legitimate, signed version of 3CXDesktopApp, and thus constitutes a supply chain attack.
Reports & references
- Kaspersky — 110355 (report)
- ESET — Linux Malware Strengthens Links Lazarus 3Cx Supply Chain Attack (report)
- virusbulletin.com — Lazarus Campaigns And Backdoors In 2022 2023 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.3Cx Backdoor (report)
- fortinet.com — 3Cx Desktop App Compromised (report)
- cadosecurity.com — Forensic Triage Of A Windows System Running The Backdoored 3Cx Desktop App (report)
- elastic.co — Elastic Users Protected From Suddenicon Supply Chain Attack (report)
- reddit.com — 20230329 Situational Awareness Crowdstrike (report)
- CrowdStrike — Crowdstrike Detects And Prevents Active Intrusion Campaign Targeting 3Cxdesktopapp Customers (report)
- reversinglabs.com — Red Flags Fly Over Supply Chain Compromised 3Cx Update (report)
- blog.cyble.com — A Comprehensive Analysis Of The 3Cx Attack (report)
- Broadcom/Symantec — 3Cx Supply Chain Attack (report)
- rapid7.com — Backdoored 3Cxdesktopapp Installer Used In Active Threat Campaign (report)
- blogs.blackberry.com — Initial Implants And Network Analysis Suggest The 3Cx Supply Chain Operation Goes Back To Fall 2022 (report)
- blogs.vmware.com — Investigating 3Cx Desktop Application Attacks What You Need To Know (report)
- zscaler.com — 3Cx Supply Chain Attack Analysis March 2023 (report)
- github.com — Smoothoperator.Md (report)
- splunk.com — Splunk Insights Investigating The 3Cxdesktopapp Supply Chain Compromise (report)
- huntress.com — 3Cx Voip Software Compromise Supply Chain Threats (report)
- Trend Micro — Information On Attacks Involving 3Cx Desktop App (report)
- research.openanalysis.net — 3Cx Malware (report)
- volexity.com — 3Cx Supply Chain Compromise Leads To Iconic Incident (report)
- group-ib.com — 3Cx Supply Chain Attack (report)
- sentinelone.com — Smoothoperator Ongoing Campaign Trojanizes 3Cx Software In Software Supply Chain Attack (report)
- youtube.com — Watch (report)