On March 29, a 3CX supply chain attack was reported. Kaspersky researchers analyzed available reports on this campaign and reviewed their own telemetry. On one machine, researchers observed a suspicious Dynamic Link Library (DLL) that was loaded into the infected 3CXDesktopApp.exe process.
Kaspersky experts opened an investigation into a case linked to that DLL on March 21, about a week before the supply chain attack was discovered. That DLL was used in deployments of a backdoor that was dubbed “Gopuram” and had been tracked internally since 2020. Three years ago, Kaspersky investigated an infection of a cryptocurrency company located in Southeast Asia. During the investigation, it was found that Gopuram coexisted on victim machines with AppleJeus, a backdoor attributed to the Korean-speaking threat actor Lazarus.
As for the victims in Kaspersky’s telemetry, installations of the infected 3CX software are located all over the world, with the highest infection figures observed in Brazil, Germany, Italy and France. Despite that, Gopuram has been deployed to less than ten machines, which indicates that attackers used this backdoor with surgical precision. Kaspersky additionally observed that the attackers have a specific interest in cryptocurrency companies.
“The infostealer is not the only malicious payload deployed during the 3CX supply chain attack. The threat actor behind Gopuram additionally infects target machines with the fully-fledged modular Gopuram backdoor. We believe that Gopuram is the main implant and the final payload in the attack chain. Our investigation of the 3CX campaign is ongoing and we will continue analyzing the deployed implants to find out more details about the toolset used in the supply chain attack,” – comments Georgy Kucherin, a security expert at GReAT, Kaspersky.
Learn more about Gopuram backdoor and the supply chain attack on Securelist.
To protect against Gopuram-like threats, follow these recommendations:
o Provide your staff with basic cybersecurity hygiene training, as many targeted attacks start with phishing or other social engineering techniques;
o Carry out a cybersecurity audit of your networks and remediate any weaknesses discovered in the perimeter or inside the network.
o Install anti-APT and EDR solutions, enabling threat discovery and detection, investigation and timely remediation of incidents capabilities. Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within Kaspersky Expert Security framework.
o Along with proper endpoint protection, dedicated services can help against high-profile attacks. The Kaspersky Managed Detection and Response service can help identify and stop attacks in their early stages, before the attackers achieve their goals.
We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.