wp-plugin-hostgator
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114ol-scrapes
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114Source:https:\/\/techcrunch.com\/2023\/04\/20\/3cx-supply-chain-xtrader-mandiant\/<\/a><\/br> The incident responders investigating how hackers carried out a complex supply-chain attack targeting enterprise phone provider 3CX say the company was compromised by\u00a0another<\/em> supply chain attack.<\/p>\n 3CX, which develops a software-based phone system<\/a> used by more than 600,000 organizations worldwide with more than 12 million active daily users, worked with cybersecurity company Mandiant to investigate the incident. In its report released on Thursday, Mandiant said that attackers compromised 3CX using a malware-laced version of the X_Trader financial software, developed by Trading Technologies.<\/p>\n X_Trader was a platform used by traders to view real-time and historical markets, which Trading Technologies phased out in 2020, but Mandiant says was still available to download from the company\u2019s website in 2022.<\/p>\n Mandiant said it suspects the Trading Technologies website was compromised by a group of North Korea state-backed hackers, which it refers to as UNC4736.<\/p>\n This is backed up by a report from<\/a> Google\u2019s Threat Analysis Group from last year, which confirmed that Trading Technologies\u2019 website was compromised in February 2022 as part of a North Korean operation targeting dozens of cryptocurrency and fintech users. U.S. cybersecurity agency CISA says<\/a> the hacking group has used its custom \u201cAppleJeus\u201d malware to steal cryptocurrency from victims in over 30 countries.<\/p>\n Mandiant\u2019s investigation found that a 3CX employee downloaded a tainted version of the X_Trader software in April 2022 from Trading Technologies\u2019 website, which the hackers had digitally signed with the company\u2019s then-valid code-signing certificate to make it look as if it was legitimate.<\/p>\n Once installed, the software planted a backdoor on the employee\u2019s device, giving the attackers full access to the compromised system. This access was then used to move laterally through 3CX\u2019s network and, eventually, to compromise 3CX\u2019s flagship desktop phone app to plant information-stealing malware inside their customers\u2019 corporate networks.<\/p>\n \u201cThis is notable to us because this is the first time we\u2019ve ever found concrete evidence of a software supply chain attack leading to another supply chain attack,\u201d said Mandiant\u2019s chief technology officer Charles Carmakal. \u201cThis series of coupled supply-chain attacks just illustrates the increasing cyber offensive cyber capability by North Korean threat actors.\u201d<\/p>\n Mandiant says it notified Trading Technologies about the compromise on April 11 but says it\u2019s not known how many users are affected.<\/p>\n Trading Technologies spokesperson Ellen Resnick told TechCrunch that the company has not yet verified Mandiant\u2019s findings, and reiterated that it stopped supporting the software in 2020.<\/p>\n Mandiant\u2019s Carmakel added that it\u2019s likely \u201cmany more victims\u201d related to the two supply-chain attacks will become known in the coming weeks and months.<\/p>\n<\/p><\/div>\n <\/br><\/br><\/br><\/p>\n
\n3CX\u2019s supply chain attack was caused by\u2026 another supply chain attack<\/br>
\n2023-04-20 22:11:05<\/br><\/p>\n