# Elastic users protected from SUDDENICON’s supply chain attack

Backdoored 3CXDesktopApp MSI ships trojanized ffmpeg.dll/d3dcompiler_47.dll that decrypts SUDDENICON shellcode after a 7-day delay and beacons to C2 for an infostealer.

- Payout: Real-world hack
- Severity: high
- Program: 3CX
- Analysis by: Daniel Stepanic, Remco Sprooten, Joe Desimone, Samir Bousseaden, Devon Kerr
- Disclosed: 2023-05-05
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/elastic-users-protected-from-suddenicon-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-users-protected-from-suddenicon-supply-chain-attack
- Tags: area:os domain:desktop impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:github-actions tech:windows technique:reverse-engineering technique:source-review vuln:secrets-leak

**Target:** 3CXDesktopApp Windows/macOS desktop client (MSI/DMG installers, ffmpeg.dll, d3dcompiler_47.dll)
**Root cause:** The 3CXDesktopApp installer MSI contains malicious code that waits seven days post-installation before downloading additional files from GitHub and contacting C2 domains; both ffmpeg.dll and d3dcompiler_47.dll were backdoored, with ffmpeg.dll extracting SUDDENICON from d3dcompiler_47.dll via the FEEDFACE marker and a static RC4 key.
**Steps:**
1. Install a trojanized 3CXDesktopApp MSI (e.g. `3cxdesktopapp-18.12.407.msi`); client writes `ffmpeg.dll` and `d3dcompiler_47.dll` to disk.
2. `ffmpeg.dll` loads `d3dcompiler_47.dll`, seeks the `FEEDFACE` byte sequence, and RC4-decrypts with static key `3jB(2bsG#@c7)` to extract SUDDENICON.
3. Prepended shellcode stub (APPLEJEUS-like) maps payload into memory and writes a `manifest` file with a timestamp 7 days in the future as a timer.
4. After the timer, malware resolves `raw.githubusercontent.com`, downloads icon files from the IconStorages GitHub repo, and base64-decodes trailing bytes to retrieve C2 domains.
5. Malware POSTs a machine identifier to an active C2, then downloads and decrypts a new executable (an infostealer).
**How found:** Triage of CrowdStrike/Todyl reports of a 3CX supply-chain compromise; analysts compared shipped DLLs against legitimate names, spotted ffmpeg.dll loading d3dcompiler_47.dll, and located the FEEDFACE marker plus static RC4 key to carve the SUDDENICON payload.
**Exploitation:** Adversary overwrote benign components of the 3CXDesktopApp via update channels, so signed 3CX software self-delivers the backdoor; after a 7-day sleep the implant beacons to C2 with a machine ID and pulls a second-stage infostealer executable.
**Insight:** Legitimate DLL names like ffmpeg.dll and d3dcompiler_47.dll can be backdoored in signed installers — hunt for signed processes resolving raw.githubusercontent.com and for DLLs loaded from the executable directory that are unsigned or not matching the process name.

## Proof of concept (copied exactly from the original report)

**KQL query for 3CX DNS to raw.githubusercontent.com**

```
process.name : "3CXDesktopApp.exe" and dns.question.name : "raw.githubusercontent.com"
```

**KQL query for malicious DLL hashes**

```
dll.hash.sha256  : "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896" or dll.hash.sha256 :  "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
```

**EQL sequence for 3CX DLL load and C2 DNS**

```
sequence by host.name, process.entity_id[process where process.code_signature.subject_name:"3CX Ltd"][library where dll.hash.sha256:"c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02","7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"][network where dns.question.name:"raw.githubusercontent.com"]
```