The softphone client manufacturer was compromised by attackers and distributed malicious code to clients via updates.
Since March 22nd, an increasing number of users have reported apparent false alarms about network access to domains such as "akamaicontainer.com" or "azureonlinecloud.com". These addresses appear harmless at first glance, but they are in fact control servers used by the attackers.
The attack apparently occurred via two DLLs named "d3dcompiler_47.dll" and "ffmpeg.dll". These were downloaded via an update and were fully functional from the software's perspective, so that the compromise would remain undetected for as long as possible.
According to the software manufacturer, Windows versions 18.12.407 and 18.12.416 are affected. MacOS was also not spared, with Mac versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416 also affected.
3CX recommends uninstalling the Windows and macOS desktop apps. Furthermore, regular and complete scans The process will be carried out. The PWA web client is not affected and should currently be used as an alternative.
Our support as a Master MSP
With our Managed Endpoint Security, we can identify devices with 3CX software installed and initiate targeted scans. Full scans have already started and are running in the background. Detected threats are immediately removed.
Nevertheless, we advise you to follow the recommendations from 3CX.
You're not using our Managed Endpoint Security yet?
Get started right away – Performance recording (EGIS)
Learn more - Website | video | Handout
And to help you get started selling this product to your customers quickly and easily, we have prepared the most important documents:
Fillable handout for end customers
Service description (SYNAXON>Partner)
Service description (Partner>Customer)
Never miss an update again! Register now for our SYNAXON Services Newsfeed, so that important notifications land directly in your inbox.