Contextualizing Events & Enabling Defense: What 3CX Means

This report examines the March 2023 supply-chain compromise of the 3CXDesktopApp in which malicious updates delivered a browser-information-collection payload (initially present in macOS builds and later in Windows updates), discusses attribution to Labyrinth Chollima (Lazarus), timelines and operational artifacts dating back to 2022–2023, and provides analysis of adversary objectives, detection opportunities across the kill chain, and defensive recommendations for containment, recovery, and business continuity.