3CX_Supply_Chain_Attack__Blackhat_2023_.pdf (37 MB)

Patrick Wardle’s slide deck analyzes the macOS side of the 3CX supply-chain compromise, a nation-state operation in which 3CX’s build environments were compromised after an earlier supply-chain intrusion. The deck focuses on the POOLRAT backdoor used on the macOS build server, the malicious library inserted into 3CXDesktopApp updates, and the self-deleting second-stage payload delivered to macOS enterprise users. It describes POOLRAT as a lightweight C/C++ macOS backdoor capable of collecting system information, executing commands, securely deleting files, reading and writing files, and updating configuration. The material also documents C2 strings, YARA/XProtect-style detection logic, code-signing observations, and heuristic detection approaches for similar macOS supply-chain attacks.