YaS

We have Kaspersky MDR and it blocked the 3CX desktop app on March 30. The first version of the app that is know to be compromised is the 18.12.407 (the March version). We don't know if we didn't started installing the compromised version before that date or if it wasn't flaged. Alarms by some security vendors, about the compromised version, started around the 22 March but were mostly classed as false positive. But the malware seems to be dormant for at least 7 days (+ some random number) after its installation. Which would, maybe, explain why it really started to be notice the 29 March.