The Many Faces Of The CrowdStrike Scam

Cybersecurity is paramount whether you are chronically online or use the Internet just to pay your utility bills. Unfortunately, even the most reliable firms can encounter issues that open doors for cybercriminals. A recent incident involving CrowdStrike, a renowned American cybersecurity firm, illustrates this perfectly. Here's a detailed look at what happened, how cybercriminals exploited the situation, and how you can protect yourself.

What Happened with CrowdStrike?

CrowdStrike specializes in endpoint security, threat intelligence, and cyberattack response services. On July 19, 2024, the firm released an update for Windows systems. However, this update contained an error that caused systems to crash with the dreaded Blue Screen of Death (BSOD). This system failure created an unexpected vulnerability that cybercriminals were quick to exploit.

Exploiting the CrowdStrike Error

One of the notable campaigns targeting this vulnerability involved a fake CrowdStrike Hotfix update directed at BBVA bank customers. Cybercriminals set up a phishing page disguised as a BBVA Intranet portal, prompting users to download a malicious archive file. This file contained a Remote Access Trojan (RAT) known as Remcos.

A RAT allows attackers to remotely control an infected computer, enabling keylogging, file transfers, and surveillance. This malicious software was promoted through instructions urging users to install the update to avoid network errors, thus compromising their systems.

Phishing Emails and Data Wipers

Another malicious campaign emerged through phishing emails. Cybercriminals instructed recipients to download a ZIP file containing a fake CrowdStrike update. This file, however, housed a data wiper—a type of malware designed to permanently erase or corrupt data on a computer.

These phishing emails played on users' fears, leveraging the initial CrowdStrike update error to trick them into further compromising their systems.

Here's the text from the email:

Dear Valued Customer

CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not impacted. This was not a cyberattack.

The issue has been identified, isolated and a fixed has been deployed.

We are referring customers to update their Windows servers as soon as possible through through the attached tool to avoid disruptions!

We further recommend organizations ensure they're communicating with CrowdStrike representatives through official channels.

Our team is fully mobilized to ensure the security and stability of CrowdStrike customers.

We understand the gravity of the situation and are deeply sorry for the inconvenience and disruption. We are working with all impacted customers to ensure that systems are back up and they can deliver the services their customers are counting on.

Obviously, the consequences of any failure to update the system and disruption will be the responsibility of the organization's IT manager.

Cryptocurrency Scams

The CrowdStrike error also spurred a range of scams involving fake cryptocurrency tokens. Scammers promoted fictitious tokens like $CROWDSTRIKE or $CROWDSTROKE, tricking individuals into disclosing sensitive information or transferring cryptocurrency. These scams often led to financial losses for the victims.

Fake Compensation Offers

In another twist, scammers impersonated companies offering compensation to those affected by the CrowdStrike update error. These fraudulent offers aimed to extract sensitive information, payments for fake services, or even access to victims' computers. Such scams could lead to further infections, data encryption, and financial losses.

Common Scam Tactics

Scammers used various channels to target users affected by the CrowdStrike error. Email and compromised social media accounts were common methods, particularly on X (formerly Twitter). Deceptive advertisements and notifications from untrustworthy websites also played a significant role.

Other avenues included rogue advertising networks found on illegal movie streaming pages and torrent sites, SMS and messaging apps, ads from installed adware, and online forums. These methods are designed to lure users into clicking on links that lead to scam pages.

Protecting Yourself from Scams

To safeguard against these threats, it's crucial to verify the legitimacy of links before clicking, especially those in unsolicited emails or messages. Avoid interacting with pop-ups, buttons, links, and ads on suspicious websites. Download applications only from reliable sources, such as official web pages or app stores, and steer clear of websites offering pirated software or illegal services.

Final Thoughts

The CrowdStrike update error underscores the importance of vigilance in the face of cyber threats. Cybercriminals quickly seized the opportunity to exploit the situation, launching campaigns involving RATs, data wipers, fake tokens, and fraudulent compensation offers. By staying informed and adopting safe online practices, users can better protect themselves from such scams.

Remember, cybersecurity is not just about having the right software; it's also about being aware of cybercriminals' tactics and taking proactive steps to avoid falling victim to their schemes. Stay alert, stay informed, and always verify before you trust.