Huntress investigated the 3CX DesktopApp compromise as a large supply-chain incident affecting legitimate 3CX updates, with affected Windows versions 18.12.407 and 18.12.416 observed across customer environments. The attack chain used a backdoored ffmpeg.dll loader to load d3dcompiler_47.dll, which contained an encrypted FE ED FA CE-marked payload decrypted with an RC4 key that other reporting associated with DPRK threat activity. The decrypted shellcode embedded another PE loader that slept for seven days before retrieving GitHub-hosted icon files from IconStorages/images, where appended encoded data decrypted to multiple command-and-control URLs. Huntress highlighted process lineage, malicious 3CXDesktopApp.exe hashes, the GitHub icon repository, and domains including akamaitechcloudservices.com, pbxsources.com, msedgeupdate.net, and visualstudiofactory.com as detection and hunting leads.