36gate: supply chain attack

Group-IB documents a March 2023 supply-chain compromise of the 3CX Desktop App in which attackers trojanized signed Windows and macOS installers (malicious ffmpeg.dll / libffmpeg components) that deploy encrypted shellcode and a downloader contacting numerous cloud-like C2 domains; the report includes technical analysis, extensive IoCs (hashes, domains, filesystem artifacts), mitigation guidance (uninstall/update, hunt with YARA/Sigma/EDR), and notes tentative links to a DPRK-nexus APT though attribution remains unconfirmed.