A U.S. cybersecurity firm has attributed a recent attack on a popular business communications tool to a North Korean hacker network associated with the Lazarus Group.

CrowdStrike said it observed malicious activity originating from 3CXDesktopApp, a voice and video conferencing software product developed by virtual phone service company 3CX, in a post on its website Wednesday.

This malicious activity reportedly included “beaconing” to infrastructure controlled by the threat actor, deployment of additional payloads, and in some cases, remote activity carried out directly by attackers already inside the target’s operating environment. 

CrowdStrike