BlogTrace : Curated intelligence from security blog posts.

3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

Blog Source: Mandiant

IOC Available: no

YARA Rules: yes

Timestamp: 2023.10.23
SmoothOperator | Ongoing Campaign Trojanizes 3CXDesktopApp in Supply Chain Attack

Blog Source: SentinelOne

IOC Available: yes

YARA Rules: yes

Timestamp: 2023.05.29
Elastic users protected from SUDDENICON’s supply chain attack

Blog Source: elastic

IOC Available: yes

YARA Rules: yes

Timestamp: 2023.05.05
Linux malware strengthens links between Lazarus and the 3CX supply-chain attack

Blog Source: Welivesecurity

IOC Available: yes

YARA Rules: yes

Timestamp: 2023.04.20
Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack

Blog Source: Securelist

IOC Available: yes

YARA Rules: no

Timestamp: 2023.04.03
Ironing out (the macOS) details of a Smooth Operator (Part II)

Blog Source: objective-see

IOC Available: yes

YARA Rules: no

Timestamp: 2023.04.01
3CX Supply Chain Attack Campaign

Blog Source: Zscaler

IOC Available: yes

YARA Rules: no

Timestamp: 2023.03.31
Supply Chain Attack Using 3CX PABX Software

Blog Source: Trustwave

IOC Available: yes

YARA Rules: no

Timestamp: 2023.03.31
Contextualizing Events & Enabling Defense: What 3CX Means

Blog Source: Huntress

IOC Available: no

YARA Rules: no

Timestamp: 2023.03.31
Splunk Insights: Investigating the 3CXDesktopApp Supply Chain Compromise

Blog Source: Splunk

IOC Available: no

YARA Rules: no

Timestamp: 2023.03.31