{"id":838,"date":"2023-03-31T13:02:33","date_gmt":"2023-03-31T13:02:33","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/kompromitiran-je-lanac-opskrbe-3cx-aplikacije\/"},"modified":"2026-11-04T08:50:30","modified_gmt":"2026-11-04T08:50:30","slug":"kompromitiran-je-lanac-opskrbe-3cx-aplikacije","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/kompromitiran-je-lanac-opskrbe-3cx-aplikacije\/","title":{"rendered":"Kompromitiran je lanac opskrbe 3CX aplikacije"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>3CX, desktop aplikacija za upu\u0107ivanje poziva putem interneta (VOIP), postala je trojanac za kra\u0111u podataka. <\/strong>3CX koriste brojne poznate kompanije kao \u0161to su Toyota, McDonald's, Honda, BMW, Mercedes, Coca-Cola i dr.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2023-29059\">CERT CVE-2023-29059<\/a><\/strong><\/li><li><strong><a href=\"https:\/\/www.3cx.com\/blog\/news\/desktopapp-security-alert\/\">3CX DesktopApp Security Alert<\/a><\/strong><\/li><li><strong><a href=\"https:\/\/github.com\/enisaeu\/CNW\/blob\/main\/advisories\/CVE-2023-XXXXX_3CX-DesktopApp.md\">GitHub CVE-2023-XXXXX_3CX-DesktopApp.md<\/a><\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Najnovije dostupno a\u017euriranje ove aplikacije pokazalo se zlonamjernim, a do trojanizacije aplikacije do\u0161lo je zbog kompromitacije lanca opskrbe. <a href=\"https:\/\/www.crowdstrike.com\/blog\/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers\/\">CrowStrike<\/a> smatra kako se radi o sjevernokorejskoj dr\u017eavno sponzoriranoj skupini Lazarus.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nakon preuzimanja aplikacije ili a\u017euriranja za ve\u0107 instaliranu ina\u010dicu, preuzimaju se i zlonamjerne DLL datoteke (<a href=\"https:\/\/www.virustotal.com\/gui\/file\/7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896\">ffmpeg.dll<\/a> i <a href=\"https:\/\/www.virustotal.com\/gui\/file\/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03\">d3dcompiler_47.dll<\/a>) koje se koriste za preuzimanje dodatnih malicioznih datoteka s ciljem kra\u0111e podataka i komunikaciju s malicioznom infrastrukturom, a u pojedinim slu\u010dajevima i upravljanje zara\u017eenim ra\u010dunalom.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Maliciozne verzije 3CX Desktop aplikacije:<br>- Windows: 18.12.407 i 18.12.416\u00a0<br>- Mac: 18.11.1213, 18.12.402, 18.12.407 i 18.12.416<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Savjetujemo \u010di\u0161\u0107enje ra\u010dunala s navedenim verzijama aplikacije te provjeru indikatora kompromitacije<\/strong> koji se nalaze na sljede\u0107im poveznicama:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[1] <a href=\"https:\/\/www.volexity.com\/blog\/2023\/03\/30\/3cx-supply-chain-compromise-leads-to-iconic-incident\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.volexity.com\/blog\/2023\/03\/30\/3cx-supply-chain-compromise-leads-to-iconic-incident\/<\/a><br>[2] <a href=\"https:\/\/www.sentinelone.com\/blog\/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.sentinelone.com\/blog\/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack\/<\/a><br>[3] <a href=\"https:\/\/www.crowdstrike.com\/blog\/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.crowdstrike.com\/blog\/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>3CX, desktop aplikacija za upu\u0107ivanje poziva putem interneta (VOIP), postala je trojanac za kra\u0111u podataka. 3CX koriste brojne poznate kompanije kao \u0161to su Toyota, McDonald&#8217;s, Honda, BMW, Mercedes, Coca-Cola i dr. CERT CVE-2023-29059 3CX DesktopApp Security Alert GitHub CVE-2023-XXXXX_3CX-DesktopApp.md Najnovije dostupno a\u017euriranje ove aplikacije pokazalo se zlonamjernim, a do trojanizacije aplikacije do\u0161lo je zbog kompromitacije [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1324,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-838","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=838"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/838\/revisions"}],"predecessor-version":[{"id":1328,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/838\/revisions\/1328"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1324"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=838"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=838"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}