{"id":8342,"date":"2025-11-11T04:01:16","date_gmt":"2025-11-11T04:01:16","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/11\/11\/32464\/"},"modified":"2025-11-11T04:01:16","modified_gmt":"2025-11-11T04:01:16","slug":"32464","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/11\/11\/32464\/","title":{"rendered":"It isn’t always defaults: Scans for 3CX usernames, (Mon, Nov 10th)"},"content":{"rendered":"\n
It isn’t always defaults: Scans for 3CX usernames, (Mon, Nov 10th)<\/div>\n

\t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Today, I noticed scans using the username “FTP_3cx” showing up in our logs. 3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems. But Google came up empty for this particular string. The 3CX software does not appear to run an FTP server, but it offers a feature to back up configurations to an FTP server [2]. The example user used in the documentation is “3cxftpuser”, not “FTP_3cx”. Additionally, the documentation notes that the FTP server can run on a different system from the 3CX software. For a backup, it would not make much sense to have it all run on the same system.<\/p>\n

The scans we are seeing likely target FTP servers users set up to back up 3CX configurations, and not the 3CX software itself. I am not familiar enough with 3CX to know precisely what the backup contains, but it most likely includes sufficient information to breach the 3CX installation.<\/p>\n

The credentials we observe with our Cowrie-based honeypots are collected for telnet and ftp. In particular, on Linux systems, you often use a system user to connect via FTP. Any credentials working via FTP will also work for telnet or SSH. Keep that in mind when configuring a user for FTP access, and of course, FTP should not be your first choice for backing up sensitive data, but we all know it does happen.<\/p>\n

Here are the passwords attacks are attempting to use:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Password<\/th>\nCount<\/th>\n<\/tr>\n<\/thead>\n
3CXBackup<\/td>\n4<\/td>\n<\/tr>\n
3CXbackups<\/td>\n4<\/td>\n<\/tr>\n
telecom<\/td>\n1<\/td>\n<\/tr>\n
testbackup<\/td>\n1<\/td>\n<\/tr>\n
backup3cx<\/td>\n1<\/td>\n<\/tr>\n
ebsftpuser<\/td>\n1<\/td>\n<\/tr>\n
ftp_cxn<\/td>\n1<\/td>\n<\/tr>\n
ftp_inx<\/td>\n1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Here are some other “3cx” related usernames we have seen in the past:<\/p>\n\n\n\n\n\n\n\n\n\n\n
Username<\/th>\n<\/tr>\n<\/thead>\n
3cx<\/td>\n<\/tr>\n
3CXBackup<\/td>\n<\/tr>\n
3cxbackups<\/td>\n<\/tr>\n
backup3cx<\/td>\n<\/tr>\n
ftp3cx<\/td>\n<\/tr>\n
FTP_3cx<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

If anyone with more 3CX experience reads this, is there a reason for someone to use these usernames? Or are there any defaults I didn’t find?<\/p>\n

[1]\u00a0https:\/\/www.3cx.com
\n[2]\u00a0https:\/\/www.3cx.com\/docs\/ftp-server-pbx-backups-linux\/<\/p>\n

—
\nJohannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu<\/a>
\nTwitter<\/a>|<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

It isn’t always defaults: Scans for 3CX usernames, (Mon, Nov 10th) Today, I noticed scans using the username “FTP_3cx” showing up in our logs. 3CX is a well-known maker of business phone system software [1]. My first guess was that this was a default user for one of their systems. But Google came up empty […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-8342","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8342"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8342"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8342\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}