3CX Cascading Supply-Chain Compromise

During the morning, an endpoint started generating endpoint telemetry that pointed at a single application as the root of everything that followed, yet that application is signed and on the approved software list. Work the endpoint image-load and process records and identify the dependency module the trusted application loaded that does not belong.

The malicious module did not arrive as its own program, it rode inside a legitimate, signed application and was executed because that application loaded it from its own directory. Map this execution method to its MITRE ATT&CK technique.

Right after the bad module loaded, the trusted process reached out to a host it has no business contacting and pulled down files that were not what they appeared to be. Identify the external host the trusted application retrieved its hidden next-stage payload from.

Once the next stage was in place, the trusted process settled into a steady rhythm of outbound check-ins designed to look like ordinary web traffic. Identify the external address the process beaconed to over HTTPS.

A second-stage module was dropped and run to steal what was stored on the endpoint, reaching into a running application's memory to do it. Identify the module that was loaded to carry out the browser theft.

Beyond the workstations, the operators made sure their code would survive a reboot on a more valuable system by planting a file where a trusted service would load it. Identify the host where the persistence DLL was staged.