Security Update Tuesday 11 April 2023 - Interim Assessment Concluded

[Pierre_3CX]

Initial Results from Mandiant Incident Response​

Following the appointment of Mandiant as our security incident response team, forensic analysis on our network and product is in progress. In a nutshell, the interim assessment concluded:

Attribution​

Based on the Mandiant investigation into the 3CX intrusion a...

Continue reading the Original Blog Post.

 

[Alphabetic]

Do we know what it's purpose was or if It attempted to steal any information?

 

[Ruth Elizabeth Abbott]

Do we know what it's purpose was or if It attempted to steal any information?

Although there's much speculation in the media we don't have any confirmed information of the purpose or aims of the attack. Like any investigation we expect it to be thorough. But thorough investigations also take time. As you'll be aware 3CX has appointed Mandiant to undertake the investigation. We're confident that we're being guided by experienced and knowledgeable threat researchers, reverse engineers, intelligence analysts and incident responders. They've been defending organizations of all sizes at the front lines of cyber conflict since 2004. So whilst we wait for further information from them, we've been asking for patience. We do not want to jeopardize their investigation with premature conclusions. If and when we can, we will! This we can promise.

 

[Fred Jelk | PC-Profi GmbH]

How can I use this Yara-Rule? Should I embbed this rule in thor? How?

i saw some computers with <machine hardware profile GUID>.TxR.0.regtrans-ms and <machine hardware profile GUID>.TxR.1.regtrans-ms and <machine hardware profile GUID>.TxR.2.regtrans-ms and so on... is there really a problem? I'm still not sure. I think, these are files from Windows Search. Isn't it?

 

[SteveITS]

How can I use this Yara-Rule

See https://www.3cx.com/community/threads/forensic-scanner-nextron-thor.120005/ in the Supply Chain Attack Info & Support category.

Interesting this list of C2 hostnames is way shorter than lists published elsewhere.

 

[Pierre_3CX]

@Fred Jelk | PC-Profi GmbH in this folder you will find legitimate files from the OS you shouldn't delete them blindly.
Thor authors confirmed that their ruleset includes detection rules for these signatures so if you will use it just run the first command to upgrade and then run scan. Any other EDR or tool that understands YARA syntax can also be used.

@SteveITS indeed, note that the findings reported here are from our own network audit so the domains used may differ.

 

[Charli]

Thor authors confirmed that their ruleset includes detection rules for these signatures so if you will use it just run the first command to upgrade and then run scan.

Just to make sure, after running the update command, Thor will show alerts when:

• a malicious file in C:\Windows\System32\config\TxR\ is found
• a malicious C:\Windows\system32\wlbsctrl.dll is found
• any of the 4 mentioned C&C domains are found in log files etc

is this correct?

Kind regards!

 

[ltri37]

While it is interesting which directory the malware writes to on a Windows and Mac, we are more interested in how your supply chain and build machines got compromised and how you solve that problem moving forward.

 

[Pierre_3CX]

@Charli
That would be a question for the Thor authors but we reached them out on that and they indicated the following:

- an infected file in C:\Windows\System32\config\TxR\ is found
No, not yet. Because THOR cannot evaluate the machine GUID at runtime and then include that evaluated ID in a signature.
But we can try to detect these files in a different way. I’m discussing this with my team we think that we can work with a meta rule and tags.

- an infected C:\Windows\system32\wlbsctrl.dll is found
Yes.

- any of the 4 mentioned C&C domains are found
Yes.

These last two indicators got detected even before the Mandiant report.

 

[Charli]

@pj3cx Thank you very much for the clarifications and checking back with the Thor developers!

 

[Kevin Cyrtel]

Hello, we are currently experiencing an issue regarding the deployment of 3CX on Azure. I don't know if this is related to recent events but when we want to deploy a virtual machine from the PBX we don't have all the Azure VM bundles available. Also the 3CX Azure application has disappeared. What can we do ? Thanks in advance

 

[jarodt]

Thank you for the updates and insights. I have a question for clarification:
I ran yara with your mentioned rule and didnt get any warnings. Despite I do have the mentioned files in windows\system32\config\TxR\
Does that already indicate that source files for TAXHAUL have been loaded to the system but is not active as my systems don't have the .dll library yet? As said yara didn't jump on the regtrans-ms files.
Thanks for your help!

 

[Pierre_3CX]

Hi @jarodt,
If the YARA rule did not find an issue then nothing to do, this folder is expected to have files with long GUIDs that are related to registry operations and should not be deleted blindly. You may run a full AV scan as well just to confirm that there are no remnants of any malware on disk.