Malware

SUDDENICON

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence1

The threat was able to introduce adversary-created malicious software via update channels, overwriting otherwise benign components of the 3CXDesktopApp.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The resulting payload is then loaded in memory as the second-stage payload... Memory Threat Detection Alert: Shellcode injection Windows.Trojan.SuddenIcon.

Stealth

5 techniques

T1027.003SteganographyEvidence1

C2 domains are retrieved by downloading and base64-decoding the trailing bytes appended to icon files staged in the IconStorages Github repository.

T1027.009Embedded PayloadsEvidence1

The ffmpeg.dll binary extracts SUDDENICON from d3dcompiler_47.dll by seeking the FEEDFACE byte sequence and decrypting using a static RC4 key.

T1027.013Encrypted/Encoded FileEvidence1

C2 domains are retrieved by downloading and base64-decoding the trailing bytes appended to icon files staged in the IconStorages Github repository.

T1055Process InjectionEvidence1

The resulting payload is then loaded in memory as the second-stage payload... Memory Threat Detection Alert: Shellcode injection Windows.Trojan.SuddenIcon.

T1497.003Time Based ChecksEvidence1

The 3CXDesktopApp installer MSI appears to contain malicious code which waits seven days post-installation before downloading additional files... A new file (manifest) [is written] with a timestamp 7 days in the future, used to implement a timer.

Discovery

1 technique

T1497.003Time Based ChecksEvidence1

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

After initially connecting to an active C2 server, the malware performs a POST containing a machine identifier.

T1102.003One-Way CommunicationEvidence1

C2 domains are retrieved by downloading and base64-decoding the trailing bytes appended to icon files staged in the IconStorages Github repository.

T1105Ingress Tool TransferEvidence1

The installer... waits seven days post-installation before downloading additional files from GitHub... After initially connecting to an active C2 server, the malware... downloads and decrypts a new executable.

INDICATORS OF COMPROMISE

IOCs tracked for this family

31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

21 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 days ago

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

elastic security labsNews

May 5, 2023

SUDDENICON의 공급망 공격으로부터 보호되는 Elastic 사용자 - Elastic Security Labs

Backdoored component delivered via a trojanized 3CXDesktopApp supply-chain update. It is extracted/decrypted from a DLL (d3dcompiler_47.dll) by another DLL (ffmpeg.dll) using RC4, loaded in-memory with a shellcode stub, delays execution ~7 days via a dropped 'manifest' file/timer, retrieves C2 domains from GitHub-hosted icon files (base64-decoded trailing bytes), posts a machine identifier to C2, then downloads/decrypts an additional executable (noted as likely an infostealer).

elastic security labsNews

May 5, 2023

Elastic users protected from SUDDENICON’s supply chain attack

A second-stage payload delivered through the compromised 3CXDesktopApp supply chain. It is extracted and RC4-decrypted by the trojanized ffmpeg.dll, memory-mapped via shellcode, delays C2 activity for seven days, obtains C2 domains from encoded data appended to icon files, posts a machine identifier, and downloads/decrypts a further executable initially assessed as an information stealer.

virusbulletinNews

Aug 14, 2026

Mentioned only in references as prior related research.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching31

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

SUDDENICON

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.002Compromise Software Supply ChainEvidence1

The threat was able to introduce adversary-created malicious software via update channels, overwriting otherwise benign components of the 3CXDesktopApp.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The resulting payload is then loaded in memory as the second-stage payload... Memory Threat Detection Alert: Shellcode injection Windows.Trojan.SuddenIcon.

Stealth

5 techniques

T1027.003SteganographyEvidence1

C2 domains are retrieved by downloading and base64-decoding the trailing bytes appended to icon files staged in the IconStorages Github repository.

T1027.009Embedded PayloadsEvidence1

The ffmpeg.dll binary extracts SUDDENICON from d3dcompiler_47.dll by seeking the FEEDFACE byte sequence and decrypting using a static RC4 key.

T1027.013Encrypted/Encoded FileEvidence1

C2 domains are retrieved by downloading and base64-decoding the trailing bytes appended to icon files staged in the IconStorages Github repository.

T1055Process InjectionEvidence1

The resulting payload is then loaded in memory as the second-stage payload... Memory Threat Detection Alert: Shellcode injection Windows.Trojan.SuddenIcon.

T1497.003Time Based ChecksEvidence1

Discovery

1 technique

T1497.003Time Based ChecksEvidence1

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

After initially connecting to an active C2 server, the malware performs a POST containing a machine identifier.

T1102.003One-Way CommunicationEvidence1

C2 domains are retrieved by downloading and base64-decoding the trailing bytes appended to icon files staged in the IconStorages Github repository.

T1105Ingress Tool TransferEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

21 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 days ago

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

elastic security labsNews

May 5, 2023

SUDDENICON의 공급망 공격으로부터 보호되는 Elastic 사용자 - Elastic Security Labs

elastic security labsNews

May 5, 2023

Elastic users protected from SUDDENICON’s supply chain attack

virusbulletinNews

Aug 14, 2026

Mentioned only in references as prior related research.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching31

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.