Exploiting Global Outages: Threat Actors Masquerade as CrowdStrike in Phishing Campaign with Fake Falcon Sensor Update
Saptang Labs
Leading AI-ML platform for unified cyber fraud management and threat intelligence, protecting your brand and customers
Executive Summary
At Saptang Labs, we are dedicated to staying at the forefront of cybersecurity by providing timely information on the latest threats facing organizations worldwide. Recently, cybercriminals have capitalized on a global issue concerning the Windows Blue Screen of Death (BSOD) to launch a sophisticated phishing campaign. This campaign has primarily involved two key threat actors: the Handala Group, known for their deployment of wiper malware, and another unnamed group using the Remcos Remote Access Trojan (RAT) to target CrowdStrike customers in Latin America. Additionally, there has been a significant increase in the registration of phishing domains impersonating CrowdStrike. These developments highlight the rapidly evolving tactics of cyber adversaries and underscore the importance of maintaining vigilant cybersecurity measures.
Introduction
The Windows BSOD Outage: A Cybersecurity Alert
Recently, a widespread issue involving the Windows Blue Screen of Death (BSOD) has caused significant disruptions to systems worldwide. This critical system error has rendered countless devices inoperable, leading to widespread confusion and a desperate search for solutions. Cybercriminals have seized this opportunity to launch a sophisticated phishing campaign, exploiting the confusion and urgency of the situation.
These malicious actors are distributing a fake update for the CrowdStrike Falcon sensor, falsely claiming it will resolve the BSOD issue. The campaign involves sending deceptive emails and messages, posing as communications from CrowdStrike, a reputable cybersecurity company. These phishing emails are crafted to appear legitimate, featuring the CrowdStrike logo and branding, and promise a critical update to fix the BSOD problem.
Cyber Threats Involved
In addition to the phishing campaign, two significant threats have been identified:
Furthermore, cybercriminals have registered numerous fake CrowdStrike domains to enhance the credibility of their phishing campaigns, increasing the likelihood of successful attacks. These incidents highlight the evolving tactics of cyber adversaries and the critical need for vigilant cybersecurity measures to protect against such sophisticated threats.
Handala Group Spreads Wiper Malware Disguised as CrowdStrike Update
The Handala Group, a well-known cyber threat actor, has recently executed a campaign deploying wiper malware disguised as a CrowdStrike update. Claiming responsibility through their Telegram group, Handala targeted thousands of Zionist organizations, resulting in substantial data loss amounting to several terabytes. The group's involvement has been publicly confirmed through announcements on their Telegram channel.
Malware Operation by Handala Breakdown
The phishing campaign uses a fake CrowdStrike domain, crowdstrike.com.vc, to trick customers into downloading a tool to fix a purported CrowdStrike issue. The emails contain a PDF with instructions for running the fake update and a link to download a malicious ZIP archive from a file hosting service. This ZIP file includes an executable named Crowdstrike.exe.
Initial Infection
Once the fake update is downloaded and executed, the malware begins its operation by establishing communication with external servers. This initial phase is crucial for the malware to gather information and prepare for further malicious actions.
Communication with Telegram Bot
One of the primary steps in the malware's operation is to establish contact with a Telegram bot. This communication channel is used to receive instructions and send back data from the infected system. Telegram bots are often used by cybercriminals due to their ease of use, reliability, and the ability to remain relatively anonymous.
Malware Tactic: Using icanhazip.com?to Identify Public IP Addresses
The malware connects to icanhazip.com?to obtain the public IP address of infected systems. This tactic allows cybercriminals to gather critical network information, enabling further exploitation or control of compromised devices.
Malware Tactic: Leveraging VBA Scripts for System Exploitation
The malware drops a VBA script into the system to execute its intended activities. This script automates malicious tasks, compromising the system's security and allowing the attacker to control or damage the affected machine. The use of VBA scripts demonstrates the malware's capability to exploit system vulnerabilities efficiently.
Analysis of VBA Script Dropped by the Malware
The VBA script performs several tasks, including:
Purpose of the Script
The script appears to perform the following tasks:
领英推荐
Conclusion on Working of Script
The script is an obfuscated batch script designed to:
TTPs (Tactics, Techniques, and Procedures):
IOCs (Indicators of Compromise):
Malware Activities: A Breakdown of the Attack Process
The malicious executable begins its operation immediately upon launch, dropping the executable file and initiating CMD.EXE for command execution. It reads the date of Windows installation and checks the security settings of Internet Explorer, preparing for further actions.
The malware executes commands from a ".cmd" file and ensures its persistence by launching itself. It gathers information on running processes and either drops or overwrites executable content. Using 'findstr.exe', it searches for specific text patterns in files, outputting the results.
In its attempt to evade detection, the malware drops a file with a rarely used extension (PIF) and runs the executable file from the user directory via the CMD process. It engages in suspicious file concatenation and starts applications with unusual extensions.
To delay execution, it uses TIMEOUT.EXE and drops legitimate Windows executables to blend in with normal system activities. The malware even drops a system driver, possibly to evade defenses, and creates files with names similar to system files.
Finally, the malware starts Microsoft applications from unusual locations, further complicating detection efforts. Each of these activities reflects the sophisticated tactics employed by the malware to disrupt systems and evade security measures.
Malicious ZIP Archive Impersonating CrowdStrike Update Targets Latin American Users
Cybersecurity threats continue to evolve, with attackers leveraging trusted brands to deceive users. A recent campaign has been identified targeting Latin America-based CrowdStrike customers, utilizing the domain portalintranetgrupobbva.com?to impersonate the well-known BBVA bank.
The Attack Vector
The malicious ZIP archive, named crowdstrike-hotfix.zip, contains Spanish-language instructions that direct users to execute a file purportedly to apply a “hotfix” for a CrowdStrike issue. However, instead of resolving any issue, the executable deploys the HijackLoader malware loader, which then installs and runs the RemCos RAT (Remote Access Trojan) from the attacker’s command-and-control (C2) server.
Notable Observations
Conclusion
This campaign underscores the need for vigilance and robust cybersecurity measures, as attackers continue to refine their tactics to bypass defenses and exploit trusted brands.
Saptang Labs
Saptang Labs conducted the research leading to the discovery of these threats. For detailed information on Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs), please contact Saptang Labs at [email protected].
Contact Information
For more information and inquiries about this research, please contact:
Stay vigilant and protect your organization from evolving cyber threats.
Request our comprehensive report to safeguard your digital assets and ensure robust cybersecurity measures are in place. You may email us or write " I am interested" in the comments and we will share it with you.