Stuxnet targets supervisory control and data acquisition ( SCADA) systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran. In the meantime, 3CX has hired the cybersecurity team Mandiant to investigate the incident and is urging clients to uninstall the company’s desktop app.Stuxnet is a malicious computer worm first uncovered in 2010 and thought to have been in development since at least 2005. However, it's still unclear how the hackers managed to infiltrate the VoIP company to deliver the malware. Separate cybersecurity firms Crowdstrike and Sophos have also found evidence linking the 3CX supply chain attack to Lazarus. Back in 2020, Kaspersky also discovered a Gopuram backdoor on a machine at a cryptocurrency company that had been installed with another backdoor, dubbed AppleJeus, which the US has attributed to North Korea. The presence of Gopuram also adds more evidence that the hack of 3CX is connected to a notorious North Korean state-sponsored hacking group, dubbed Lazarus, which has an appetite for stealing cryptocurrency.

Features include the ability to view file systems and create malicious processes on an infected machine. However, Kaspersky’s report says the hacker also launched an additional payload for select machines in the form of a backdoor known as 'Gopuram.'īut according to the company’s own data, Gopuram was deployed “to less than ten infected machines.” Once it installs, the backdoor lets a hacker secretly hijack a computer. Indeed, the tainted 3CX was found distributing an infostealer program capable of gathering data from a computer’s browser. So the hack has sparked fears that a wide range of companies are affected, especially since antivirus companies detected a surge of malicious infections occuring through legitimate 3CX desktop apps last week. “We found out that the threat actor specifically targeted cryptocurrency companies,” the company says, citing its own telemetry, which includes users of Kaspersky’s antivirus protection.ģCX provides VoIP services to thousands of businesses, including major brands like McDonald's, Coca-Cola, and BMW. Best Hosted Endpoint Protection and Security Software.

Kaspersky malware