Malware Attacks Alert - Malicious Malware Activities in the Theme of CrowdStrike Outage Event

Malware Attacks Alert

Current Status and Related Trends

On July 19, 2024, an issue present in a single content update for the CrowdStrike Falcon sensor software impacting Microsoft Windows operating systems was identified, official fix has been released from both CrowdStrike and Microsoft. News has indicated that threat actors have been using the mentioned event to leaverage further cyber attacks.

Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) found reports that criminals continue to evolve their attack tactics. Those include using fake CrowdStrike recovery manuals, fake remediation solutions and fake software updates to deliver unidentified malware, which could lead to sensitive data leakage, system crashes, and data loss. According to related information, HKCERT has observed the following attack tactics to spread malware that are taking advantage of this incident:

• Fake recovery manual
  A new type of malware is spreading through Word documents that contain macros. These documents pretend to be Microsoft recovery guides to trick people into opening them. Once opened, the macros activate and start stealing sensitive information like passwords. This stolen information is then sent to the attacker's server.
• Fake remediation solutions
  Through phishing sites and fake intranet portals to promote fake CrowdStrike hotfix. Fake hotfix delivered a malware loader then dropped a remote access tool that can be controlled by hackers on the infected system.
• Fake CrowdStrike update
  Phishing emails included a link to download a ZIP file that contained an executable named 'Crowdstrike.exe'. After being executed, "data wiper" was extracted to a folder under "%Temp%"and launched to destroy data stored on the device.