Unit 42 described the 3CXDesktopApp incident as a supply-chain compromise in which malicious libraries were included in legitimate Windows MSI and macOS DMG installers downloaded from 3CX. On Windows, 3CXDesktopApp.exe loads ffmpeg.dll, which decrypts shellcode from d3dcompiler_47.dll using the RC4 key 3jB(2bsG#@c7 and then sleeps for a randomized 1-4 week period before contacting infrastructure. The malware retrieves icon files from the removed IconStorages GitHub repository and extracts C2 URLs such as officestoragebox[.]com/api/session, then can load a backdoor for additional malware. Unit 42 observed blocked shellcode activity across 127 Cortex XDR customers and noted broad exposure because 3CX applications were fingerprinted on hundreds of thousands of IP addresses worldwide.