type: campaign
spec_version: 2.1
id: campaign--4fd53ccc-c6b1-4e3c-abe8-a456d46d789e
created: 2025-08-25T22:00:39.072Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0057
external_id: C0057
source_name: 3cx official statement 2023
description: Agathocles Prodromou. (2023, April 20). Security Update Thursday 20 April 2023 – Initial Intrusion Vector Found. Retrieved August 25, 2025.
url: https://www.3cx.com/blog/news/mandiant-security-update2/
source_name: Krebs 3cx overview 2023
description: Brian Krebs. (2023, April 20). 3CX Breach Was a Double Supply Chain Compromise. Retrieved May 22, 2025.
url: https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/
source_name: Kaspersky 3CX Gopuram 2023
description: Georgy Kucherin, Vasily Berdnikov, Vilen Kamalov. (2023, April 3). Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack. Retrieved August 25, 2025.
url: https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/
source_name: Mandiant 3cx UNC4736 2023
description: Jeff Johnson, Fred Plan, Adrian Sanchez, Renato Fontana, Jake Nicastro, Dimiter Andonov, Marius Fodoreanu, Daniel Scott. (2023, April 20). 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible. Retrieved August 25, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-23T18:32:38.121Z
name: 3CX Supply Chain Attack
description: The [3CX Supply Chain Attack](https://attack.mitre.org/campaigns/C0057) was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with [AppleJeus](https://attack.mitre.org/groups/G1049), access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.(Citation: Mandiant 3cx UNC4736 2023) While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.(Citation: Kaspersky 3CX Gopuram 2023) The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.(Citation: 3cx official statement 2023)(Citation: Krebs 3cx overview 2023)
aliases: 3CX Supply Chain Attack
first_seen: 2022-11-01T06:00:00.000Z
last_seen: 2023-03-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Mandiant 3cx UNC4736 2023)
x_mitre_last_seen_citation: (Citation: 3cx official statement 2023)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Austin Larsen and the Google Threat Intelligence Group
Michael “Barni” Barnhart, DTEX
x_mitre_domains: enterprise-attack