25/07/2024
Actualité
Update on Crowdstrike’s incident
On July 19, Crowdstrike published an update on the sensors deployed on customer’s endpoints that caused a production incident on Windows. This event led to multiple exploitation attempts by threat actors:
- Threat actors are disseminating what are in reality malware and data wipers under the guise of « fixes » for the CrowdStrike problem. These phony fixes promise to resolve BSOD difficulties, but in reality, they install malware such as the Remcos remote access tool, which gives hackers access to compromised systems.
- The incident is being instrumentalized by attackers to impersonate Crowdstrike and deploy phishing campaigns using the brand’s name.
- A data wiper that overwrites files and makes them unrecoverable has been deployed via a phony update that is being promoted as a CrowdStrike patch.
We advise you to pay particular attention to communications alledgedly emanating from Crowdstrike and keep track of the publication of new IOC.
Further information can be found here: https://www.crowdstrike.com/blog/falcon-sensor-issue-use-to-target-crowdstrike-customers/
