Suspected North Korean Hackers Breach 3CX Software, Exposing Supply Chain Risk Across Global Firms

On Thursday, private investigators laid out how suspected North Korean hackers got inside 3CX, a software company that says it has hundreds of thousands of customers worldwide. The company's voice and video calling software is used by multinational firms of every kind, from hotel chains to health care providers. The breach, discovered last month, gave the hackers a potential foothold in a wide swath of those organizations.

How they got in is what stands out. According to Mandiant Consulting, which 3CX hired to investigate, the hackers first compromised software made by another company, the derivatives trading platform Trading Technologies. A 3CX employee then downloaded a tampered version of that now-defunct Trading Technologies software, and that download gave the attackers a path into 3CX's software production environment. Charles Carmakal, Mandiant's chief technology officer, told reporters Wednesday it was the first time his team had found concrete evidence of one supply chain attack leading to another. He said it reflects an increased level of offensive cyber capability among North Korean operatives.

Trading Technologies has not confirmed any of this. A spokesperson told CNN on Thursday that the company only became aware of the issue last week and has not yet been able to verify Mandiant's findings. The spokesperson did state with certainty that 3CX is neither a vendor nor a customer of Trading Technologies, and stressed that the incident is unrelated to the company's current TT platform.

The reach of the hack remains unclear. Any 3CX customer that downloaded the bugged software would have been susceptible to compromise, but CrowdStrike, a US cybersecurity firm, says the North Koreans likely picked a much smaller group of victims for follow-on activity inside their networks. Nick Galea, 3CX's CEO, told CNN on March 30 that very few customers appeared to be actually compromised. In an email Thursday, he said he does not know how many customers downloaded the tampered software, or how many saw further hacking activity. 3CX has told customers how to update their software and check for signs of compromise.

Some targeting is known. Georgy Kucherin, a researcher at the Russian cybersecurity firm Kaspersky, told CNN that the suspected North Korean hackers used the 3CX access late last month to go after cryptocurrency firms. His company saw attempts to deploy malicious code on fewer than 10 computers, he said, but blocked them, so nothing was stolen.

That fits a pattern. A recent CNN investigation found a rampant North Korean effort to steal cryptocurrency and launder it into cash that could help fund the regime's weapons programs. A senior US official previously told CNN that such activity appears in regular intelligence products shown to senior officials, sometimes including President Joe Biden. The 3CX case is the latest evidence that North Korean hackers are working hard to steal from or spy on organizations in support of Kim Jong Un's strategic interests.

US officials and corporate executives have been scrambling to determine how many American organizations may be affected. A spokesperson for the Cybersecurity and Infrastructure Security Agency said the agency continues to work with government and private sector partners to understand the impact of the intrusion campaign. The spokesperson added that in many cases, work by the cybersecurity community avoided significant harm for potential victims.

Adam Meyers, CrowdStrike's vice president of intelligence, noted that sweeping supply chain hacks have typically been associated with state-linked hackers from China or Russia. North Korea's involvement, he said, shows it has supply chain capabilities and aspirations and can produce real effects with them. What remains to be learned is how many victims there were and what the hackers did once inside.