If you are a client of Advantage Computing we just wanted to post on our website that all Contracted Clients under our monitoring and control have not been compromised to our knowledge in the latest software attack.
According to Huntress the breach of the VOIP Desktop Software Application from 3CX was used to push out malicious payloads to computers that the software was installed on. This type of attack was being caught by anti-virus software for sometime now and IT providers were whitelisting it not knowing that the supply chain of the software had been breached at it’s core.
People who had 3CX installed on their computers have most likely had their internal passwords stolen and credentials scraped from websites. Around 600,000 businesses are now currently working on forcing password updates across the board for their clients.
To our knowledge at this time (March 30th, 2023) none of our monitored computers have the software in question installed. If you are a client of Advantage Computing and know that you are using the 3CX Desktop Application – turn your computer off and call Advantage Computing immediately so we can remediate the software.
We will not be sending any emails regarding this breach as none of our clients were affected at this time and we will point any requests for updates to this post.
This is one of the key reasons why we do our due diligence to push Business Security Standards. User accounts compromised in this attack can be used to attack additional infrastructure which is why least privileged is so important. Centralized Control of user accounts for forced password updates and auditing of activity becomes paramount in remediation of these type of issues.
Sadly, this will not be the last attack. We are currently testing and adding Huntress to our Security Stack and will be offering their products hopefully by Q3 of 2023 to clients interested in increasing their security coverage.