Curious call log entry / connection from external to external

[Andreas Conrad]

Hi there 3CX community,

I got a curious case of an extension seemingly initiating an external conference call and then those external numbers calling each other?
Sadly those call logs are all I have, no pcaps or higher log levels -> 3CX support couldn´t really help.
The 3CX extension was compromised during these events.

Whats the most plausible explanation for this kind of call log entry ?

kind regards

 

[Andreas Conrad]

case solved, it´s the entries you get from

internal extension -> external A
attended transfer -> external B
complete transfer

and is a technique used to max out the lines in a compromised 3CX if you only breached one extension.
--

Not used to seeing transfers to external, so it looked strange to me.