The 3CX DesktopApp Supply Chain Attack

Updated 5 Oct 2026 · Incident date 13 Mar 2023 · vendor binary

Package3CX Electron Desktop App: Windows 18.12.407 and 18.12.416; macOS 18.11.1213, 18.12.402, 18.12.407, 18.12.416
Fileffmpeg.dll

The 3CX DesktopApp for Windows, versions 18.12.407 and 18.12.416, contained a trojanized library. The macOS builds 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 were also affected. The attack became public on 29 March 2023, and the issue is tracked as CVE-2023-29059.

On Windows the bad file was ffmpeg.dll. It decrypted a hidden payload, then fetched instructions from the internet.

Major incident. Mandiant traced the 3CX intrusion to a compromised X_TRADER installer. Attackers then compromised the 3CX software build environment. Impact source

What happened

Signed 3CX installers carried malicious libraries. Unit 42 describes the Windows chain. The MSI installer puts the files in place and starts 3CXDesktopApp.exe. That program loads the bad ffmpeg.dll. The DLL reads an encrypted blob that hides inside d3dcompiler_47.dll and decrypts it with RC4.

The decrypted code then downloads icon files from a GitHub repository. Each icon file holds an encoded address, and the code extracts the command server address from it. It then contacts that server for a second-stage payload. Unit 42 reports that the first icon files appeared in the GitHub repository on 7 December 2022.

The macOS build used libffmpeg.dylib with 16 command server addresses built in. It did not use GitHub.

Unit 42 also reports that its Xpanse scans found 247,277 distinct IP addresses in 199 countries that ran 3CX applications. CrowdStrike attributed the activity to the group it calls Labyrinth Chollima, according to Unit 42. Fortinet notes that the file was a legitimate signed file that had been trojanized, and that 3CX revoked the certificates of the previous versions.

Affected versions

Unit 42, Fortinet and 3CX's advisory data agree on these versions.

Fortinet recommends moving to the latest version. It names 18.12.422 for Windows as a fixed build. Fortinet also suggests the web-based PWA client as an alternative.

Indicators of compromise

How to check

Compare the hash of the DLL in your 3CX install folder with the value above. On Windows PowerShell:

Get-ChildItem -Path "$env:LOCALAPPDATA\Programs\3CXDesktopApp","C:\Program Files\3CXDesktopApp" -Recurse -Filter ffmpeg.dll -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256

On macOS, look for the extra files that Fortinet names.

ls -la /Applications/3CX\ Desktop\ App.app/Contents/MacOS | grep -E "UpdateAgent|\.main-storage|\.session-lock"

Also search your DNS logs for the command domains.

What to do now

  1. Uninstall affected versions and install the latest 3CX build, or use the PWA client.
  2. Search your endpoints and logs for the hashes and domains above.
  3. If you find a match, isolate the host and treat it as compromised.
  4. Rotate credentials that were stored on or reachable from that host.
  5. Check network logs for connections to the command domains and to the GitHub icon files.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. Here ffmpeg.dll gained decrypt-and-run and download behavior. See all attacks.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

vigi diff --old 3CX-prev --new 3CX-current
files scanned: 10

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    ffmpeg.dll
           It now downloads from the internet and runs other programs. It did not before.

Frequently asked questions

Which 3CX DesktopApp versions were compromised?

On Windows, 18.12.407 and 18.12.416. On macOS, 18.11.1213, 18.12.402, 18.12.407 and 18.12.416.

How do I check if 3CX DesktopApp was compromised?

Hash the ffmpeg.dll in the install folder and compare it with the published SHA-256 value. On macOS, look for UpdateAgent, .main-storage and .session-lock files in the app folder.

Sources

  1. unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/
  2. fortinet.com/blog/threat-research/3cx-desktop-app-compromised
  3. objective-see.org/blog/blog_0x73.html

More supply chain attacks

All 111 attacks in the library · What is a supply chain attack? · How to prevent supply chain attacks

Check the next update before you install it

Vigilance compares the version you trust with the new one. It names the one file that can now do something it could not do before.

Start Free