Summary
- Environment: VoIP software supply chain
- Operational impact: Notable "double supply chain" attack — 3CX itself was compromised via an earlier trojanized trading app
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2023, 3CX experienced an incident in its voip software supply chain environment. The retained source describes the attack path as follows: North Korean-linked (Lazarus/UNC4736); trojanized desktop app. [1]
The documented consequence was: Notable “double supply chain” attack — 3CX itself was compromised via an earlier trojanized trading app. [1]
Impact
- Documented impact: Notable “double supply chain” attack — 3CX itself was compromised via an earlier trojanized trading app. [1]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Timeline
Documented public update
The 3CX software supply chain compromise records the incident facts used in this briefing.
[1]Briefing updated
This briefing was last reviewed and updated on September 19, 2026.
Threat Group & Attack Vector
The retained source describes the attack path as follows: North Korean-linked (Lazarus/UNC4736); trojanized desktop app. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- Lazarus/UNC4736 — identified in the supported attack description. [1]
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.
This account is bounded to 3CX software supply chain compromise. Details absent from that evidence are left unresolved rather than inferred. [1]