Active Intrusion Campaign Targeting 3CXDesktopApp Customers


Userlevel 7
Badge +7
  • Veeam Legend
  • 717 comments

Something to watch out for if you are using the 3CXDesktopApp in your environment. There is not much info available at the moment but according to CrowdStrike:

“The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity. “

More here: 


5 comments

Userlevel 7
Badge +8

That’s quite an attack. We right away informed customers we know to use 3CX systems.

Here some recent intel from 3CX: https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/

Userlevel 7
Badge +7

It seems “only”  version numbers 18.12.407 & 18.12.416 are affected: https://www.3cx.com/blog/news/desktopapp-security-alert/

Userlevel 7
Badge +9

Great share @dips!

Userlevel 7
Badge +7

It's going to be really interesting once the info is out about what exactly happened but looks to be quite bad. Especially with the large amount of high profile clients

Userlevel 7
Badge +20

Never really heard about this technology but interesting read for sure. Thanks for sharing.

Comment