<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:remialcxesans;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:wf_segoe-ui_normal;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsonormal, li.xmsonormal, div.xmsonormal
{mso-style-name:x_msonormal;
margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.xxmsonormal, li.xxmsonormal, div.xxmsonormal
{mso-style-name:x_xmsonormal;
margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.xxxcontentpasted0
{mso-style-name:x_xxcontentpasted0;}
span.EmailStyle27
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Their CEO has posted an update confirming it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><a href="https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/">https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <ausnog-bounces@lists.ausnog.net>
<b>On Behalf Of </b>Greg Lipschitz<br>
<b>Sent:</b> Thursday, March 30, 2023 2:04 PM<br>
<b>To:</b> Matthew Mace <matthew@htsol.com.au>; Nathan Brookfield <Nathan.Brookfield@iperium.com.au>; Christopher Hawker <chris@thesysadmin.dev>; Rob Thomas <xrobau@gmail.com>; <ausnog@lists.ausnog.net> <ausnog@lists.ausnog.net><br>
<b>Subject:</b> Re: [AusNOG] Critical 3CX Windows/Mac hack.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">We have the paid whiz bang M365 version (you can tell I use Windows, right!?)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">When we removed it and then reinstalled it, it grabbed it straight away.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="background:white;border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Greg Lipschitz</span></b><b><span style="font-size:1.0pt;font-family:"remialcxesans",serif;color:white"></span></b><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"><o:p></o:p></span></b></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"> | <o:p></o:p></span></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Founder & CEO<o:p></o:p></span></b></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"> | <o:p></o:p></span></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Summit Internet<o:p></o:p></span></b></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="mailto:glipschitz@summitinternet.com.au" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#253374;font-weight:normal">glipschitz@summitinternet.com.au</span></strong></a><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="http://summitinternet.com.au" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#253374;font-weight:normal">summitinternet.com.au</span></strong></a><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="tel:1300%20049%20749" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#000001;font-weight:normal;text-decoration:none">1300 049 749</span></strong></a><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="https://www.google.com/maps?cid=12522583051503623677&_ga=2.149009334.1057584350.1554770858-1081443428.1554770858" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#000001;font-weight:normal;text-decoration:none">Unit 2, 31-39 Norcal Road, Nunawading VIC 3131</span></strong></a><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:7.5pt 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:1.0pt;color:black"><map name="MicrosoftOfficeMap0"></map><img border="0" width="66" height="22" style="width:.6875in;height:.2291in" id="Picture_x0020_1" src="cid:image002.png@01D96318.5E590EC0" usemap="#MicrosoftOfficeMap0"></span><span style="font-size:1.0pt"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:1.0pt;color:black"><img border="0" width="590" height="106" style="width:6.1458in;height:1.1041in" id="Picture_x0020_2" src="cid:image003.png@01D96318.5E590EC0"></span><span style="font-size:1.0pt"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:7.5pt 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><a href="http://summitinternet.com.au/" target="_blank"><span style="font-size:1.0pt;text-decoration:none"><img border="0" width="179" height="33" style="width:1.8645in;height:.3437in" id="Picture_x0020_3" src="cid:image004.png@01D96318.5E590EC0" alt="Summit Internet"></span></a><span style="font-size:1.0pt"><o:p></o:p></span></p>
</td>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal" align="right" style="text-align:right"><span style="font-size:1.0pt"><img border="0" width="278" height="66" style="width:2.8958in;height:.6875in" id="Picture_x0020_4" src="cid:image005.png@01D96318.5E590EC0"></span><span style="font-size:1.0pt"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Matthew Mace <<a href="mailto:matthew@htsol.com.au">matthew@htsol.com.au</a>><br>
<b>Sent:</b> 30 March 2023 16:58<br>
<b>To:</b> Greg Lipschitz <<a href="mailto:glipschitz@summitinternet.com.au">glipschitz@summitinternet.com.au</a>>; Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au">Nathan.Brookfield@iperium.com.au</a>>; Christopher Hawker <<a href="mailto:chris@thesysadmin.dev">chris@thesysadmin.dev</a>>;
Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>>; <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> RE: [AusNOG] Critical 3CX Windows/Mac hack.</span> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:#A6A6A6;padding:5.25pt 1.5pt 5.25pt 1.5pt"></td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:wf_segoe-ui_normal;color:#212121">You don't often get email from
<a href="mailto:matthew@htsol.com.au">matthew@htsol.com.au</a>. <a href="https://aka.ms/LearnAboutSenderIdentification">
Learn why this is important</a><o:p></o:p></span></p>
</div>
</td>
<td width="75" style="width:56.25pt;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 3.75pt">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="xmsonormal">Interesting!<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">How long ago did it start seeing it and was It standard defender or Endpoint Business?
<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<div>
<p class="xmsonormal"><b><span style="color:black">Matthew Mace</span></b><o:p></o:p></p>
<p class="xmsonormal"><span style="color:#757B80">Director </span><o:p></o:p></p>
<p class="xmsonormal"><span style="color:#757B80">Honest Technology Solutions</span><o:p></o:p></p>
<p class="xmsonormal"><b><span style="color:black">P: </span></b><span style="color:#757B80">07 3188 7244</span><o:p></o:p></p>
<p class="xmsonormal"><b><span style="color:black">E: </span></b><span style="color:#757B80"><a href="mailto:matthew@htsol.com.au">matthew@htsol.com.au</a></span><o:p></o:p></p>
<p class="xmsonormal"><span style="color:black"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="color:black"><a href="https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.htsol.com.au%2F&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=tvenO4p9FtY%2BA2pdX5DphxarqK7chYbN1Yhlrpm2Tg0%3D&reserved=0" title="http://www.honesttech.com.au Cmd+Click or tap to follow the link">www.htsol.com.au</a></span><o:p></o:p></p>
<p class="xmsonormal"><i><span style="color:#757B80">"Keeping IT Honest"</span></i><o:p></o:p></p>
<p class="xmsonormal"><span style="color:black"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="color:black"><img border="0" width="167" height="65" style="width:1.7395in;height:.677in" id="x_Picture_x0020_13" src="cid:image006.png@01D96318.5E590EC0"></span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:10.5pt;color:black"> </span><o:p></o:p></p>
</div>
<p class="xmsonormal"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="xmsonormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Greg Lipschitz <<a href="mailto:glipschitz@summitinternet.com.au">glipschitz@summitinternet.com.au</a>>
<br>
<b>Sent:</b> Thursday, March 30, 2023 3:48 PM<br>
<b>To:</b> Matthew Mace <<a href="mailto:matthew@htsol.com.au">matthew@htsol.com.au</a>>; Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au">Nathan.Brookfield@iperium.com.au</a>>; Christopher Hawker <<a href="mailto:chris@thesysadmin.dev">chris@thesysadmin.dev</a>>;
Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>>; <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> Re: [AusNOG] Critical 3CX Windows/Mac hack.</span><o:p></o:p></p>
</div>
</div>
<p class="xmsonormal"> <o:p></o:p></p>
<div>
<p class="xmsonormal" style="background:white"><span style="font-size:12.0pt;color:black">Windows Defender picked it up too.</span><o:p></o:p></p>
</div>
<p class="xmsonormal"> <o:p></o:p></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="background:white;border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Greg Lipschitz</span></b><b><span style="font-size:1.0pt;font-family:"remialcxesans",serif;color:white"></span></b><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"> | </span><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Founder & CEO</span></b><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"> | </span><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Summit Internet</span></b><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="mailto:glipschitz@summitinternet.com.au" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#253374;font-weight:normal">glipschitz@summitinternet.com.au</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsummitinternet.com.au%2F&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3EyM3Pd5pii4zx9Xm0aquhVe6cEiWS0sOOmaWXitziM%3D&reserved=0" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#253374;font-weight:normal">summitinternet.com.au</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="tel:1300%20049%20749" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#000001;font-weight:normal;text-decoration:none">1300 049 749</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Fmaps%3Fcid%3D12522583051503623677%26_ga%3D2.149009334.1057584350.1554770858-1081443428.1554770858&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=d2Lii8liwdK2oyNLUXSbR7C%2BaXm0TmW7dWqFByZyWpU%3D&reserved=0" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#000001;font-weight:normal;text-decoration:none">Unit 2, 31-39 Norcal Road, Nunawading VIC 3131</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:7.5pt 0cm 0cm 0cm">
<p class="xmsonormal"><span style="font-size:1.0pt;color:black"><img border="0" width="66" height="22" style="width:.6875in;height:.2291in" id="x_Picture_x0020_1" src="cid:image002.png@01D96318.5E590EC0"></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal" align="center" style="text-align:center"><span style="font-size:1.0pt;color:black"><img border="0" width="590" height="106" style="width:6.1458in;height:1.1041in" id="x_Picture_x0020_2" src="cid:image003.png@01D96318.5E590EC0"></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:7.5pt 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal"><a href="https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsummitinternet.com.au%2F&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3EyM3Pd5pii4zx9Xm0aquhVe6cEiWS0sOOmaWXitziM%3D&reserved=0" target="_blank"><span style="font-size:1.0pt;text-decoration:none"><img border="0" width="179" height="33" style="width:1.8645in;height:.3437in" id="x_Picture_x0020_3" src="cid:image004.png@01D96318.5E590EC0" alt="Summit Internet"></span></a><o:p></o:p></p>
</td>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="xmsonormal" align="right" style="text-align:right"><span style="font-size:1.0pt"><img border="0" width="278" height="66" style="width:2.8958in;height:.6875in" id="x_Picture_x0020_4" src="cid:image005.png@01D96318.5E590EC0"></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<p class="xmsonormal"> <o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="xmsonormal"><b><span style="color:black">From:</span></b><span style="color:black"> Matthew Mace <<a href="mailto:matthew@htsol.com.au">matthew@htsol.com.au</a>><br>
<b>Sent:</b> 30 March 2023 15:57<br>
<b>To:</b> Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au">Nathan.Brookfield@iperium.com.au</a>>; Christopher Hawker <<a href="mailto:chris@thesysadmin.dev">chris@thesysadmin.dev</a>>; Greg Lipschitz <<a href="mailto:glipschitz@summitinternet.com.au">glipschitz@summitinternet.com.au</a>>;
Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>>; <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> RE: [AusNOG] Critical 3CX Windows/Mac hack.</span> <o:p></o:p></p>
<div>
<p class="xmsonormal"> <o:p></o:p></p>
</div>
</div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:#A6A6A6;padding:5.25pt 1.5pt 5.25pt 1.5pt"></td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<p class="xmsonormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:wf_segoe-ui_normal;color:#212121">You don't often get email from
<a href="mailto:matthew@htsol.com.au">matthew@htsol.com.au</a>. <a href="https://aka.ms/LearnAboutSenderIdentification">
Learn why this is important</a></span><o:p></o:p></p>
</div>
</td>
<td width="75" style="width:56.25pt;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 3.75pt">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="xxmsonormal">Can anyone definitively confirm that they’ve personally seen it get picked up by anything else than S1?
<o:p></o:p></p>
<p class="xxmsonormal"> <o:p></o:p></p>
<p class="xxmsonormal">In addition to this anyone that has had it installed at a site and also run a premium DNS filtering service (Umbrella, DNS Filter etc.) and/or premium routers with DPI (Sonicwall, Firebox etc.), do you know if they picked up this traffic
and stopped it? I would be hoping so. <o:p></o:p></p>
<p class="xxmsonormal"> <o:p></o:p></p>
<p class="xxmsonormal">Definitely curious to know either way. <o:p></o:p></p>
<p class="xxmsonormal"> <o:p></o:p></p>
<p class="xxmsonormal"> <o:p></o:p></p>
<p class="xxmsonormal"> <o:p></o:p></p>
<div>
<p class="xxmsonormal"><b><span style="color:black">Matthew Mace</span></b><o:p></o:p></p>
<p class="xxmsonormal"><b><span style="color:black"> </span></b><o:p></o:p></p>
<p class="xxmsonormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="xxmsonormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>>
<b>On Behalf Of </b>Nathan Brookfield<br>
<b>Sent:</b> Thursday, March 30, 2023 2:51 PM<br>
<b>To:</b> Christopher Hawker <<a href="mailto:chris@thesysadmin.dev">chris@thesysadmin.dev</a>>; Greg Lipschitz <<a href="mailto:glipschitz@summitinternet.com.au">glipschitz@summitinternet.com.au</a>>; Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>>;
<<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> Re: [AusNOG] Critical 3CX Windows/Mac hack.</span><o:p></o:p></p>
</div>
</div>
<p class="xxmsonormal"> <o:p></o:p></p>
<p class="xxmsonormal">To be fair, they likely don’t know much yet and things are probably pretty hectic…. Give them time, crisis management is probably only kicking in now.<o:p></o:p></p>
<p class="xxmsonormal"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="xxmsonormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>>
<b>On Behalf Of </b>Christopher Hawker<br>
<b>Sent:</b> Thursday, March 30, 2023 3:31 PM<br>
<b>To:</b> Greg Lipschitz <<a href="mailto:glipschitz@summitinternet.com.au">glipschitz@summitinternet.com.au</a>>; Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>>; <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> Re: [AusNOG] Critical 3CX Windows/Mac hack.</span><o:p></o:p></p>
</div>
</div>
<p class="xxmsonormal"> <o:p></o:p></p>
<div>
<p class="xxmsonormal">It appears their sales team have no info regarding this. Just rang our Senior AM at 3CX and they've advised that they have no information, and that they are referring anyone who calls to their technical teams via support tickets in the
3CX portal.<o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal">Not a good look for them.<o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal">CH<o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div id="x_x_ms-outlook-mobile-signature">
<p class="xxmsonormal">Get <a href="https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faka.ms%2FAAb9ysg&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=wx6B%2ByjV5nWfRSpFXl2H%2F6XN4%2BgsRcdgCkIB6o05M8M%3D&reserved=0">
Outlook for Android</a><o:p></o:p></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_x_divRplyFwdMsg">
<p class="xxmsonormal"><b><span style="color:black">From:</span></b><span style="color:black"> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>> on behalf of Greg Lipschitz <<a href="mailto:glipschitz@summitinternet.com.au">glipschitz@summitinternet.com.au</a>><br>
<b>Sent:</b> Thursday, March 30, 2023 3:09:45 PM<br>
<b>To:</b> Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>>; <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> Re: [AusNOG] Critical 3CX Windows/Mac hack.</span> <o:p></o:p></p>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black">Here is a list of commands (or make a shell script) to stop it phoning home and getting more payload.</span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<div>
<p class="xxmsonormal" style="margin-bottom:12.0pt;line-height:15.75pt;background:white">
<span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:green"># Disable 3CX Unattended-Upgrades Service</span></span><o:p></o:p></p>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black">systemctl stop unattended-upgrades</span></span><o:p></o:p></p>
</div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span style="font-size:10.5pt;font-family:"Courier New";color:black"> </span><o:p></o:p></p>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:green"># Collect the version of 3CX Desktop Apps on the Server</span></span><o:p></o:p></p>
</div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span style="font-size:10.5pt;font-family:"Courier New";color:black"> </span><o:p></o:p></p>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:#795E26">cd</span></span><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black"> /var/lib/3cxpbx/Instance1/Data/Http/electron</span></span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black">ls -la * > /root/3cx-desktop-versions.log</span></span><o:p></o:p></p>
</div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span style="font-size:10.5pt;font-family:"Courier New";color:black"> </span><o:p></o:p></p>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:green"># Remove the files</span></span><o:p></o:p></p>
</div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span style="font-size:10.5pt;font-family:"Courier New";color:black"> </span><o:p></o:p></p>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black">rm -rf /var/lib/3cxpbx/Instance1/Data/Http/electron/osx/*.dmg</span></span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black">rm -rf /var/lib/3cxpbx/Instance1/Data/Http/electron/osx/*.zip</span></span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black">rm -rf /var/lib/3cxpbx/Instance1/Data/Http/electron/windows/*.msi</span></span><o:p></o:p></p>
</div>
<p class="xxmsonormal" style="line-height:15.75pt;background:white"><span class="xxxcontentpasted0"><span style="font-size:10.5pt;font-family:"Courier New";color:black">rm -rf /var/lib/3cxpbx/Instance1/Data/Http/electron/windows/*.nupkg</span></span><o:p></o:p></p>
</div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"><a href="https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.3cx.com%2Fcommunity%2Fthreads%2Fthreat-alerts-from-sentinelone-for-desktop-update-initiated-from-desktop-client.119806%2Fpage-5&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=2PuQU0clb%2Fth3Wx3bPdig9M2GcB4pthDar2xMEg4lR4%3D&reserved=0">https://www.3cx.com/community/threads/threat-alerts-from-sentinelone-for-desktop-update-initiated-from-desktop-client.119806/page-5</a></span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black">Sadly, 3CX haven't even acknowledged this yet.</span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black">It would seem that their whole CI-CD pipeline has been compromised</span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black">Greg. </span><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal" style="background:white"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<p class="xxmsonormal"> <o:p></o:p></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="background:white;border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Greg Lipschitz</span></b><b><span style="font-size:1.0pt;font-family:"remialcxesans",serif;color:white"></span></b><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"> | </span><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Founder & CEO</span></b><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001"> | </span><o:p></o:p></p>
</td>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#000001">Summit Internet</span></b><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="mailto:glipschitz@summitinternet.com.au" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#253374;font-weight:normal">glipschitz@summitinternet.com.au</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsummitinternet.com.au%2F&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3EyM3Pd5pii4zx9Xm0aquhVe6cEiWS0sOOmaWXitziM%3D&reserved=0" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#253374;font-weight:normal">summitinternet.com.au</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="tel:1300%20049%20749" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#000001;font-weight:normal;text-decoration:none">1300 049 749</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td valign="top" style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><a href="https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.google.com%2Fmaps%3Fcid%3D12522583051503623677%26_ga%3D2.149009334.1057584350.1554770858-1081443428.1554770858&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=d2Lii8liwdK2oyNLUXSbR7C%2BaXm0TmW7dWqFByZyWpU%3D&reserved=0" target="_blank"><strong><span style="font-family:"Arial",sans-serif;color:#000001;font-weight:normal;text-decoration:none">Unit 2, 31-39 Norcal Road, Nunawading VIC 3131</span></strong></a></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:7.5pt 0cm 0cm 0cm">
<p class="xxmsonormal"><span style="font-size:1.0pt;color:black"><img border="0" width="66" height="22" style="width:.6875in;height:.2291in" id="x_x_Picture_x0020_2" src="cid:image002.png@01D96318.5E590EC0"></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal" align="center" style="text-align:center"><span style="font-size:1.0pt;color:black"><img border="0" width="590" height="106" style="width:6.1458in;height:1.1041in" id="x_x_Picture_x0020_3" src="cid:image003.png@01D96318.5E590EC0"></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td valign="top" style="padding:7.5pt 0cm 0cm 0cm">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal"><a href="https://aus01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsummitinternet.com.au%2F&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3EyM3Pd5pii4zx9Xm0aquhVe6cEiWS0sOOmaWXitziM%3D&reserved=0" target="_blank"><span style="font-size:1.0pt;text-decoration:none"><img border="0" width="179" height="33" style="width:1.8645in;height:.3437in" id="x_x_Picture_x0020_4" src="cid:image004.png@01D96318.5E590EC0" alt="Summit Internet"></span></a><o:p></o:p></p>
</td>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="xxmsonormal" align="right" style="text-align:right"><span style="font-size:1.0pt"><img border="0" width="278" height="66" style="width:2.8958in;height:.6875in" id="x_x_Picture_x0020_5" src="cid:image005.png@01D96318.5E590EC0"></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<p class="xxmsonormal"> <o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_x_x_divRplyFwdMsg">
<p class="xxmsonormal"><b><span style="color:black">From:</span></b><span style="color:black"> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>> on behalf of Rob Thomas <<a href="mailto:xrobau@gmail.com">xrobau@gmail.com</a>><br>
<b>Sent:</b> 30 March 2023 14:54<br>
<b>To:</b> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>> <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject:</b> [AusNOG] Critical 3CX Windows/Mac hack.</span> <o:p></o:p></p>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="xxmsonormal">As no-one's mentioned it here yet, I just thought I'd bring up the zero-day, in the wild, active RIGHT NOW, trojan 3CX Windows and Mac apps.
<o:p></o:p></p>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal">If you, or you have clients, running 3CX, make sure they ARE NOT using the app. If they are, their machines are probably already owned, and all their stored credentials and session cookies have been leaked.<o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"><a href="https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fhackers-compromise-3cx-desktop-app-in-a-supply-chain-attack%2Famp%2F&data=05%7C01%7Cglipschitz%40summitinternet.com.au%7C3e53ff8877ba461ef70508db30e3dcce%7C0838a12f226e43dfa6e4bb63d2643a7e%7C0%7C0%7C638157527457979236%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=0gosoVz1GPGxL9o%2BGxsa7TsWLhKWPuZqU6buGcj%2BO4U%3D&reserved=0">https://www.bleepingcomputer.com/news/security/hackers-compromise-3cx-desktop-app-in-a-supply-chain-attack/amp/</a><o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal">This is really bad. Sorry 8-(<o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal">--Rob<o:p></o:p></p>
</div>
<div>
<p class="xxmsonormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>