Galea suggested customers uninstall then reinstall the app, adding the company plans to do an analysis and will issue a report later Thursday. The cybersecurity firm has sent out 2,595 incident reports where the 3CXDesktopApp.exe binary matches known malicious hashes and was signed by 3CX on March 13.ģCX confirmed an advanced persistent threat actor is behind a targeted attack that is impacting its Windows Electron app running update 7, CEO Nick Galea said in an alert Thursday. Shodan data indicates more than 242,000 publicly exposed 3CX phone management systems, according to Huntress. Its customers include major firms like PepsiCo, the U.K.'s National Health Service, Best Western and Air France, according to the 3CX website.

The Cybersecurity and Infrastructure Security Agency confirmed it is aware of reports the phone app has been trojanized and is urging organizations to review information provided by CrowdStrike and SentinelOne and hunt for indicators of compromise.ģCX technology is used by more than 600,000 corporate customers globally and has more than 12 million active daily users. Other researchers have not been able to confirm activity on macOS.ĬrowdStrike researchers said the attack is connected to a threat actor known as Labyrinth Chollima, a group linked to the Democratic People's Republic of Korea, which has been active since at least 2009. The app is available on Windows, macOS, Linux and mobile, however CrowdStrike says activity has so far been observed on Windows and macOS.

Planet 7 mobile app