The 3CX Hack In Retrospect
Source: YouTube · John Hammond · published Oct 26, 2023 · 28:29
This presentation details the 3cx supply chain compromise incident and how SOC analysts responded 0:00, highlighting the importance of security operations in defending against sophisticated attacks 2:51.
Key Takeaways:
• The incident began when AV vendors flagged 3cx's VoIP software as malicious, with initial confusion about false positives 0:22
• CrowdStrike confirmed an active intrusion campaign involving trojanized legitimate 3cx desktop application updates 8:31
• The attack chain used malicious updates that beaconed to actor-controlled infrastructure, potentially affecting 250,000 systems 10:36
• Successful response required cross-team collaboration and industry partnerships rather than isolated efforts 18:25
The 3cx incident demonstrates how SOC analysts play a critical role in identifying, analyzing, and responding to sophisticated supply chain attacks, making the cybersecurity landscape safer for everyone.
Sources:
- 0:00 Introduction to the SOC analyst Appreciation Day presentation
- 0:22 Overview of the 3cx compromise topic
- 2:51 Beginning of the 3cx incident story
- 8:31 CrowdStrike's confirmation of the intrusion campaign
- 10:36 Details about the trojanized updates and scope
- 18:25 Emphasis on teamwork during incident response
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
super quick context for this video this is a recording of my talk and presentation for the dvo security Operation Center analyst Appreciation Day a whole day a whole event dedicated to celebrating sock analysts Security operation Center watch standers and all these individuals that put in the work day in and day out to protect our industry in cyber defense so my talk and presentation is all focused on the 3cx compromise and the supply chain incident hey if you have any interest in all the other sessions that were put on during that sock analyst appreciation day there is a link in the video description where you can see all of the recordings for all of the other sessions I believe that is jh. liveo and hey if you like stories like this and you want to hear more of them from me look I'll be …