INCIDENT REPORT · CP-2023-002
3CX desktop app supply chain attack
L3 · ELEVATEDCONFIRMED
3CX confirmed in late March 2023 that its VoIP desktop application had been trojanized in a supply chain attack. Mandiant called it the first case it had seen of one software supply chain attack leading to another.
- Incident ID
- CP-2023-002
- Disclosure date
- 30 MAR 2023
- Detection date
- Not publicly documented
- Affected countries
- Cyprus
- Plotted location
- Limassol, Cyprus (Affected software vendor headquarters (3CX))
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Software supply chain compromise of a widely deployed business communications product.
- Attack type
- Supply-Chain Attack
- Nature
- Malicious activity
- Attack vector
- Trojanized 3CX desktop app builds. Mandiant traced the initial 3CX compromise to an employee installing a backdoored X_TRADER installer from Trading Technologies, a separate supply chain compromise.
- Sectors
- Technology, Telecommunications
- Critical infrastructure
- No
- Organizations affected
- 3CX, Trading Technologies (X_TRADER), 3CX desktop app customers
- Operational consequences
- Malicious versions of a widely used business phone application were distributed to customers, giving attackers a potential foothold in downstream networks.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- Attributed by Mandiant to UNC4736, a suspected North Korea-nexus cluster (moderate confidence link to AppleJeus activity)
SOURCE REFERENCES
- [1] 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain CompromiseMandiant (Google Cloud) · cloud.google.com · 20 APR 2023
- [2] Mandiant: 3CX breach caused by second supply chain attackTechTarget · techtarget.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.