Loading story…
A supply-chain compromise of 3CXDesktopApp distributed digitally signed, trojanized installers to customers and triggered widespread detections in March 2023. Researchers said the operation, tracked as SmoothOperator, likely involved attacker infrastructure prepared as early as February 2022, while later reporting tied the campaign to the North Korea-linked Lazarus Group with medium to high confidence based on overlaps with AppleJeus infrastructure and malware traits.
Investigators found the 3CX intrusion was itself enabled by an earlier software supply-chain breach, extending the attack chain beyond a single vendor compromise. Although the malicious 3CX software reached organizations globally, a more selective second stage delivered the Gopuram backdoor to fewer than ten machines, with cryptocurrency companies identified among the high-value targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Mandiant reported that the 3CX compromise itself was the result of a previous software supply-chain intrusion, adding a new upstream stage to the incident timeline.
Kaspersky said with medium to high confidence that the 3CX supply-chain attack was connected to North Korea-linked Lazarus, citing overlaps with AppleJeus infrastructure and malware traits.
Kaspersky reported that the campaign delivered the Gopuram backdoor to fewer than ten machines, including cryptocurrency companies, showing that only a small subset of victims received the second-stage payload.
Digitally signed 3CXDesktopApp installers were compromised and delivered to 3CX customers as part of a supply-chain attack. The malicious software later enabled follow-on targeting of selected victims.
Security vendors began seeing broad detections tied to the malicious 3CX software around March 22, 2023, bringing the supply-chain attack to light.
Researchers assessed that infrastructure used in the 3CX supply-chain operation may have been set up as early as February 2022, indicating long-term preparation before the malware was distributed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies and security researchers linked North Korea’s **Lazarus Group**—also tracked as **APT38**, **BlueNoroff**, **Stardust Chollima**, and **HIDDEN COBRA**—to a long-running campaign targeting cryptocurrency exchanges, DeFi platforms, trading firms, venture capital funds, gaming companies, and high-value holders. The operation used spearphishing, fake job offers, fraudulent trading firms, social networking, and even fake Telegram groups to lure victims into downloading trojanized cryptocurrency trading and wallet applications on **Windows** and **macOS**, with activity reported across more than 30 countries. Researchers described later activity as an evolution of the earlier **AppleJeus** campaign, while U.S. agencies said the broader effort continued under the **TraderTraitor** cluster. The malicious apps—including **Celas Trade Pro**, **JMT Trading**, **Union Crypto**, **Kupay Wallet**, **CoinGoTrade**, **Dorusio**, **Ants2Whale**, **DAFOM**, **TokenAIS**, **CryptAIS**, **AlticGO**, **Esilet**, and **CreAI Deck**—appeared legitimate but installed hidden updater components, persistence mechanisms, and remote-access payloads such as **Manuscrypt** variants. Analysis of **Union Crypto** showed the malware collecting host details, installing services or LaunchDaemons, contacting command-and-control infrastructure, downloading second-stage payloads, and enabling file operations, screenshots, command execution, lateral movement, theft of private keys, and fraudulent blockchain transactions. U.S. authorities said the campaign supports North Korea’s sanctions evasion and revenue generation, and warned that cryptocurrency and blockchain firms remain likely targets.
Jun 29, 2026
North Korea-linked **Velvet Chollima**—also tracked as **Kimsuky**, **APT43**, and Microsoft’s **Ruby Sleet**—ran a financially motivated campaign that used a trojanized cryptocurrency trading application named **Tralert FX** to compromise retail crypto traders. The operation reportedly began in June 2025 and relied on an **EV-signed installer** associated with **"AgilusTech LLC"** to make the lure appear legitimate, then deployed a multi-stage malware chain designed to harvest browser credentials and cryptocurrency wallet data from infected Windows systems. The intrusion chain established persistence through **Windows scheduled tasks** and ultimately delivered **MoonPeak**, a customized **.NET XenoRAT** variant. Operators used **GitLab** for both command-and-control and data exfiltration, with infected hosts polling roughly every 30 minutes. Reporting tied the campaign to more than **4,100 operator commits** and over **90 compromised hosts** at disclosure, indicating a sustained, scalable DPRK monetization effort focused on high-volume theft from individual cryptocurrency users rather than the exchange-focused intrusions more commonly associated with Lazarus.
Jun 29, 2026A suspected North Korean threat actor compromised a maintainer account for the widely used open-source package **Axios** and pushed malicious updates for about three hours in a software supply-chain attack, according to reporting from CNN, NK News, and security researchers cited by both outlets. Google Threat Intelligence Group and Mandiant linked the operation to North Korean actors, saying the attackers likely sought information to support follow-on intrusions and cryptocurrency theft. Axios is broadly embedded in web applications and server-to-server communications, raising concern that the compromise could affect organizations across healthcare, finance, and cryptocurrency-related sectors. Incident responders said the known impact was still developing, with Huntress identifying roughly **135 compromised devices across about 12 companies** while warning the downstream victim count could grow substantially because Axios is used by thousands of enterprises. Researchers said the campaign fits Pyongyang’s established pattern of using cyber operations for revenue generation and strategic access, and warned that determining the full scope of exposure and any secondary compromises could take months.
Jun 29, 2026