10-year-old Windows bug with 'opt-in' fix exploited in 3CX attack
A 10-year-old Windows vulnerability is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still "opt-in" after all these years. This vulnerability was recently exploited in a supply chain attack on VoIP communications company 3CX, where two DLLs used by the Windows desktop application were replaced with malicious versions that download additional malware to computers. Even though the malicious DLLs were modified, Windows still showed them as correctly signed by Microsoft. This vulnerability is tracked by CVE-2013-3900 and the malicious payload used in the attack is Zloader. CVEs: CVE-2013-3900 Malware: Zloader [View Article](https://www.bleepingcomputer.com/news/microsoft/10-year-old-windows-bug-with-opt-in-fix-exploited-in-3cx-attack/)