AhnLab analyzed the 3CX supply-chain compromise from endpoint telemetry and observed related malware installs in South Korea on March 9 and March 15. The source describes malicious DLLs, ffmpeg.dll and d3dcompiler_47.dll, being loaded by the legitimate 3CXDesktopApp.exe process, with ffmpeg.dll reading and RC4-decrypting shellcode from d3dcompiler_47.dll before running downloader shellcode in memory. Although no additional downloaded payload was confirmed during AhnLab’s analysis, the campaign was known to lead to information-stealing malware and GitHub-hosted payload retrieval. AhnLab mapped detections to DLL side-loading, registry queries, and web protocol use, and listed numerous SHA-256 hashes and domains such as akamaicontainer[.]com and pbxcloudeservices[.]com as indicators for tracking the 3CX incident.