Volexity attributed the 3CX supply-chain compromise to a suspected North Korean threat actor tracked as UTA0040 and reported that malicious, 3CX-signed updates installed information-stealing malware on affected endpoints. The analysis found both Windows and macOS installers were impacted, with Windows infrastructure active by December 7, 2022 and related domains registered as early as November 2022. Volexity named the first-stage Windows malware ICONIC, which downloaded GitHub-hosted icon files, parsed appended Base64 data, decrypted it with AES-GCM, and used the decoded URLs to request a second-stage payload. The source advises isolating impacted endpoints, investigating for follow-on compromise, and rotating secrets because the reconnaissance payload could have enabled additional victim selection.