3CX attack targeted cryptocurrency companies with Gopuram malware

Woburn, MA – April 3, 2023 – Kaspersky has investigated a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. The malware behind the attack, dubbed Gopuram, has been tracked internally since 2020, but the number of infections began to increase in March 2023. The new report by Kaspersky provides an overview of the Gopuram backdoor with analysis of the latest campaign, which has affected enterprises around the world, particularly cryptocurrency companies.

After the 3CX supply chain attack was reported on March 29, Kaspersky researchers analyzed the available reports and reviewed their own telemetry. On one machine, researchers observed a suspicious Dynamic Link Library (DLL) that was loaded into the infected 3CXDesktopApp.exe process.

Kaspersky experts had opened an investigation into a case linked to that DLL on March 21, about a week before the supply chain attack was discovered. That DLL was used in deployments of a backdoor that was dubbed “Gopuram” and had been tracked internally since 2020. Three years ago, Kaspersky investigated an infection of a cryptocurrency company located in Southeast Asia. During the investigation, it was found that Gopuram coexisted on victim machines with AppleJeus, a backdoor attributed to the Korean-speaking threat actor Lazarus. 

As for the victims in Kaspersky’s telemetry, installations of the infected 3CX software are located all over the world, with the highest infection figures observed in Brazil, Germany, Italy and France. However, Gopuram has been deployed to less than ten machines, which indicates that the attackers used this backdoor with surgical precision. Kaspersky additionally observed that the attackers have a specific interest in cryptocurrency companies.

“The infostealer is not the only malicious payload deployed during the 3CX supply chain attack,” said Georgy Kucherin, a security expert at GReAT, Kaspersky. “The threat actor behind Gopuram additionally infects target machines with the fully-fledged modular Gopuram backdoor. We believe that Gopuram is the main implant and the final payload in the attack chain. Our investigation of the 3CX campaign is ongoing and we will continue analyzing the deployed implants to find out more details about the toolset used in the supply chain attack.”

Learn more about Gopuram backdoor and the supply chain attack on Securelist.

To protect against Gopuram-like threats, follow these recommendations:

o   Provide your staff with basic cybersecurity hygiene training, as many targeted attacks start with phishing or other social engineering techniques;

o   Carry out a cybersecurity audit of your networks and remediate any weaknesses discovered in the perimeter or inside the network.

o   Install anti-APT and EDR solutions, enabling threat discovery and detection, investigation and timely remediation of incidents capabilities. Provide your SOC team with access to the latest threat intelligence and regularly upskill them with professional training. All of the above is available within Kaspersky Expert Security framework.

o   Along with proper endpoint protection, dedicated services can help against high-profile attacks. The Kaspersky Managed Detection and Response service can help identify and stop attacks in their early stages, before the attackers achieve their goals.