3CX VoIP Software Compromise & Supply Chain Threats

**Executive summary:** The 3CX DesktopApp was compromised and signed updates delivered a backdoored ffmpeg.dll which loads an encrypted d3dcompiler_47.dll and subsequent payloads that sleep and then contact GitHub-hosted C2 endpoints; Huntress provides IOCs (SHA256 hashes, domains), detection guidance (YARA, process lineage) and a PowerShell checking script, and notes suspected DPRK-linked attribution and broad potential impact across hundreds of thousands of 3CX installations.