Skip to content

3CX Supply Chain Attack

Campaign · ATTACK:enterprise:C0057

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:C0057",
  "title": "3CX Supply Chain Attack",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0057",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--4fd53ccc-c6b1-4e3c-abe8-a456d46d789e",
  "external_id": "C0057",
  "domain": "enterprise",
  "created": "2025-08-25T22:00:39.072Z",
  "modified": "2026-07-31T18:47:21.686Z",
  "version": "1.0",
  "aliases": [
    "3CX Supply Chain Attack"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "3cx official statement 2023",
      "url": "https://www.3cx.com/blog/news/mandiant-security-update2/"
    },
    {
      "source_name": "Krebs 3cx overview 2023",
      "url": "https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/"
    },
    {
      "source_name": "Kaspersky 3CX Gopuram 2023",
      "url": "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
    },
    {
      "source_name": "Mandiant 3cx UNC4736 2023",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1970d1b3-ed23-44b5-a83f-d6a952714144

Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023 · Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42f40187-5451-4bf4-96e8-d15de1f395c8

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e78a70d-13b0-4539-bc43-0f45417b91c2

3cx official statement 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1195.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51d88fe0-d7b6-42dd-81fd-3b03efdf8f4c

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54947050-5539-43fe-a1b4-684900c528d4

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1543.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62aa7456-ae5e-40d5-b7e7-6831e0cca501

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:S1144

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--657d942b-48f3-4c58-a9ab-1095933ca071

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69e9e6bb-df32-4261-a8fc-4b81fca67990

Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1218.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ad89fae-ee05-40fc-b8fa-011ed917eb07

Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75daf0b5-2ad5-4950-a895-ec7a34de330b

Mandiant 3cx UNC4736 2023 · Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → attributed-to → ATTACK:enterprise:G1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c78e819-d227-4469-967d-08dc9f50edc9

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--861da25e-ea48-469d-8171-d63ad8194208

Mandiant 3cx UNC4736 2023 · Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2c7da9a-b2fc-41be-bbd5-911bcf3d0eaf

Mandiant 3cx UNC4736 2023 · Daveshell sRDI GitHub shell code loader

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa896ba8-2d2c-43c3-9264-38a52a84b713

3cx official statement 2023 · Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b41527a6-941d-47a7-b2cf-9479f4cd243f

Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023 · Mandiant 3cx UNC4736 2023 · Trend Micro 3CX AppleJeus ICONICSTEALER March 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c376fa52-2641-4c12-bd08-ad020d3f5306

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cacb6b4d-a69b-437b-b7cc-5d115bf0b30a

Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cef03277-36e0-4753-92a7-46ac4b4185a2

Mandiant 3cx UNC4736 2023 · Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d140e9e2-debf-4650-8495-26d76c3d9bd0

Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9108692-8e7e-4289-825b-29f471c914eb

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1546.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de58eda3-6389-4648-8965-8e2c096e9686

Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eabeadf0-4061-496e-bfe8-e301076181c3

Mandiant 3cx UNC4736 2023 · GitHub SigFlip opensource tool

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1218.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eeea8a71-82d7-4f7e-93d2-8c652ebb3c47

Unit42 3cx supply chain 2023

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f57211b1-df3f-4f38-a1ce-7a4f3d1d7fe1

Mandiant 3cx UNC4736 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.