Unc4736

UNC4736, a threat actor suspected to have North Korean connections, has been implicated in a series of cybersecurity breaches. The group gained initial access to the 3CX environment when an employee downloaded a financial trading package named X_TRADER from Trading Technologies' website. Unbeknownst to the user, UNC4736 had previously breached Trading Technologies' systems and inserted a backdoor into the X_TRADER app's installation file. This allowed the group to gain access to the employee's 3CX administrator credentials, which they used to infiltrate the company's network environment via a VPN connection and move laterally within the system. The incident response group Mandiant, part of Google Cloud, attributed the 3CX campaign to UNC4736. CrowdStrike, a threat intelligence firm, also tracks this group under the codename "Labyrinth Chollima," more commonly known as Lazarus Group. Notably, elements of this group were reportedly behind the X_TRADER supply chain attack discovered earlier in the year. Furthermore, Mandiant attributes both supply chain attacks to North Korean criminals tracked as UNC4736, suggesting that this is not a new group but likely related to another financially motivated North Korean operation known as AppleJeus. The UNC4736 group successfully compromised both 3CX’s Windows and macOS build environments, reinforcing the assessment of its North Korean nexus. This connection was further supported by ESET's discovery of an overlapping command-and-control (C2) domain employed in the supply chain attack and that of a Lazarus Group campaign called Operation Dream Job. The original compromise of Trading Technologies occurred at least a year ago, with a malicious X_TRADER software package available for download on the financial trading business’s website in early 2022.