ALT-50 · Analysis · 23 Oct 2026
3CX: a supply-chain attack that began with another one
A trojanised desktop phone app was signed and shipped by its vendor in 2023. Investigators traced the breach to an employee who had installed already-compromised trading software. Two supply chains, end to end.
- 2022A 3CX employee installs a trojanised X_TRADER package on a personal computer.
- 29 Mar 2023Security vendors report malicious behaviour from signed 3CX builds.
- 20 Apr 2023Mandiant publishes its findings on the X_TRADER origin.
How it chained
The trading software installer carried a backdoor. It gave the attackers a foothold on the employee's machine, then credentials, then 3CX's build environment — where they planted the malicious library in the app customers trusted.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Personal software on work-connected devices is part of the supply chain.
- A signed build from a breached vendor is still a malicious build.
- Software that is no longer supported but still distributed is a hazard.
What to do
- Keep developer and build access on managed devices only.
- Monitor what signed applications do, not only whether they are signed.
- Remove abandoned software and its installers from distribution.
Sources
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-50 — 3CX: a supply-chain attack that began with another one. 23 Oct 2026. altumptic.com/research/3cx-2023