How cyber criminals used phishing to exploit the CrowdStrike outage

Plenty has already been said about the global CrowdStrike outage in July 2024. The immediate impact on organisations around the world or the aftermath and eye-watering cost implications that are still being calculated.

However, one aspect of the outage that needs to be highlighted is the way that cyber criminals tried to take advantage of the situation for their own gain. And how this is a clear example of the opportunism that organisation’s need to always be on guard against.

The outage: A recap

CrowdStrike, a top cyber security firm known for its Falcon platform, provides endpoint protection through antivirus, EDR, and threat intelligence.

Now it’s important to note that the recent outage, which affected users of the CrowdStrike Falcon Sensor, was a system failure, not an external breach or cyber attack.

The Falcon Sensor update caused Windows to experience a BSOD (blue screen of death), rendering machines inoperable. Mac and Linux systems were unaffected.

Opportunistic phishing attacks

Whenever a significant outage occurs, cyber criminals see an opportunity to exploit the situation.

The CrowdStrike incident was no exception.

Opportunistic hackers quickly set up false CrowdStrike domains, masquerading as legitimate sources claiming to have a fix for the outage.

How these phishing attacks worked

1. Fake domains: Hackers created convincing fake websites that appeared to be affiliated with CrowdStrike.
2. Claims of a fix: These sites falsely claimed to offer a solution to the outage, enticing worried users looking for a quick fix.
3. Monetary exploitation: Visitors to these sites were often asked to make a payment to access the fix.
4. Malware installation: Instead of providing a solution, these sites would typically install malware on the victim’s system, further compromising their security.

Malicious domains

CrowdStrike released a list of identified impersonation domains.

Here’s a few examples of impersonated domains:

• crowdstrike0day[.]com
• crowdstrikebluescreen[.]com
• crowdstrike-bsod[.]com
• crowdstrikeupdate[.]com
• crowdstrikebsod[.]com
• crowdstrike0day[.]com

These domains can be added as indicators in security tools for monitoring and automatic blocking.

The intelligence can also be used for threat hunting and continuous monitoring.

Basic KQL to aid hunting and detecting

Threat Hunting (IoC based)

Continuous Monitoring

The above KQL is a great start for IoC hunting and continuous monitoring.

The Microsoft XDR table named DeviceNetworkEvents and searching for malicious domains in the RemoteUrl column could also help to identify visits to malicious domains from endpoints.

Conclusion

While the CrowdStrike outage itself may have been a system failure, it created a collateral threat from opportunistic phishing attacks that preyed on the fears and anxieties of affected users.

An incident that perfectly highlights just how quickly these financially motivated predators react when they sense an opportunity.

And a stark reminder of how organisations need constant vigilance. Not just against direct cyber attacks, but also against those who seek to exploit vulnerabilities like those seen in the aftermath of this outage.

Which is exactly why we advocate proactive threat hunting and continuous monitoring to keep one step ahead of these opportunistic threats.

Key takeaways