MALWARE FAMILY

3CX Backdoor

Internal ID: win.3cx_backdoor

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to CrowdStrike, this backdoor was discovered being embedded in a legitimate, signed version of 3CXDesktopApp, and thus constitutes a supply chain attack.

Threat Analysis

3CX Backdoor is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.cyble.com/2023/03/31/a-comprehensive-analysis-of-the-3cx-attack

→https://blogs.blackberry.com/en/2023/03/initial-implants-and-network-analysis-suggest-the-3cx-supply-chain-operation-goes-back-to-fall-2022

→https://blogs.vmware.com/security/2023/03/investigating-3cx-desktop-application-attacks-what-you-need-to-know.html

→https://github.com/dodo-sec/Malware-Analysis/blob/main/SmoothOperator/SmoothOperator.md

→https://research.openanalysis.net/3cx/northkorea/apt/triage/2023/03/30/3cx-malware.html#Functionality

→https://securelist.com/it-threat-evolution-q2-2023/110355/

→https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3cx-supply-chain-attack

→https://www.cadosecurity.com/forensic-triage-of-a-windows-system-running-the-backdoored-3cx-desktop-app/

→https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/

→https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.3cx_backdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search 3CX Backdoor