Researchers at Sophos added more evidence to back up what CrowdStrike suspected about the hack on 3CX: The software supply-chain intrusion appears to be the work of the hacking operation known as Lazarus Group.