Additional IOcs for 3cx breach
The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity.
3CXDesktopApp is a voice and video conferencing Private Automatic Branch Exchange (PABX) enterprise call routing software developed by 3CX, a business communications software company.
Featured Resources
View More Resources
Kerberos Authentication Relay Via CNAME Abuse
Originally published January 15, 2026. Updated January 21, 2026, with new attack scenarios in Cymulate Exposure Validation. Cymulate Research Labs
CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center
A subtle Azure SSO token validation flaw allowed attackers to escalate privileges and move laterally across WAC-managed systems.
Evolving Vulnerability Management to Continuous Threat Exposure Management
Shift from reactive vulnerability management to continuous, threat-validated exposure management for real risk resilience.