# 3CX VoIP Software Compromise & Supply Chain Threats

3CX's signed desktop app was trojanized via its update channel, loading a backdoored ffmpeg.dll that decrypted shellcode and beaconed to GitHub-hosted icon C2 servers.

- Payout: Real-world hack
- Severity: critical
- Program: 3CX
- Analysis by: Huntress
- Disclosed: 2023-03-30
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats
- Tags: area:os domain:desktop domain:infra impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** 3CX DesktopApp Windows/macOS signed binaries and update channel
**Root cause:** The official 3CX download/update shipped a signed 3CXDesktopApp.exe containing a backdoored ffmpeg.dll that loads an anomalous d3dcompiler_47.dll holding an RC4-encrypted (key 3jB(2bsG#@c7) secondary payload, itself a PE loader.
**Steps:**
1. Obtain affected 3CXDesktopApp (18.12.407/18.12.416 Windows; 18.11.1213/18.12.402/407/416 Mac) from official site or update.
2. ffmpeg.dll entrypoint calls mw_main_function, creates event AVMonitorRefreshEvent, resolves path and loads d3dcompiler_47.dll.
3. d3dcompiler_47.dll (Microsoft-signed) contains embedded payload marked by bytes `FE ED FA CE`.
4. ffmpeg.dll decrypts the payload via RC4 with key `3jB(2bsG#@c7`, then VirtualProtect to run shellcode.
5. Shellcode is another PE loader; final PE sleeps 7 days then beacons to C2.
6. Final PE fetches `https://raw[.]githubusercontent[.]com/IconStorages/images/main/icon%d.ico`, picks a random icon, Base64-decodes and AES-decrypts trailing data to get a C2 URL.
7. Process lineage observed: `explorer.exe` -> `3CXDesktopApp.exe` (malicious hash) -> `3CXDesktopApp.exe autoLaunch`.
**How found:** EDR/AV flagged the legitimate signed 3CXDesktopApp.exe; Huntress reverse-engineered the binary in GHIDRA/x64dbg, tracing ffmpeg.dll to d3dcompiler_47.dll, spotting the FE ED FA CE marker and RC4 key, then decrypting shellcode and icon-file payloads.
**Exploitation:** Signed malicious update delivered to ~2,783 hosts; loader decrypts embedded shellcode, waits 7 days, then randomly selects one of 16 GitHub-hosted icon files whose appended Base64/AES data yields a C2 domain (e.g. akamaitechcloudservices[.]com, msedgeupdate[.]net) for follow-on malware.
**Escalation:** Supply chain distribution via legitimate signed updates to 600k+ customers; 7-day sleep evades immediate detection; GitHub-hosted C2 hides traffic in benign-looking icon fetches.
**Insight:** Signed vendor binaries can carry a backdoored dependency DLL; hunt for anomalous sibling DLLs (e.g. d3dcompiler_47.dll next to ffmpeg.dll), magic byte markers like FE ED FA CE, and C2 hidden as appended data in valid image files fetched from GitHub raw.

## Proof of concept (copied exactly from the original report)

**Malicious child process command line autoLaunch**

```
explorer.exe \_3CXDesktopApp.exe \_ 3CXDesktopApp.exe 
… with the parent 3CXDesktopApp.exe having one of the known malicious hashes, and the corresponding child 3CXDesktopApp.exe invoked with a command line of:
[DRIVE]:\Users\Username\Local\Programs\3CXDesktopApp.exe\3CXDesktopApp.exe autoLaunch
```

**C2 URL fetched from GitHub icon files**

```
https://raw[.]githubusercontent[.]com/IconStorages/images/main/icon%d.ico
```

**RC4 key decrypting embedded payload**

```
This payload is denoted by a specific byte marker, FE ED FA CE, as others have also observed.

After retrieving d3dcompiler_47.dll, the ffmpeg.dll binary locates and unravels this secondary payload by decrypting an RC4 stream with the key 3jB(2bsG#@c7.
```