Ankura CTIX FLASH Update - July 23, 2024

Threat Actors Pose as CrowdStrike to Distribute Malware

Threat actors are capitalizing on the business disruption caused by the faulty CrowdStrike update pushed to customers late last week. Cybersecurity researchers and government agencies have identified new phishing campaigns crafted to impersonate CrowdStrike and lead potential victims into installing malware and malicious remote access tools. Threat actors are using typo-squatted domains to impersonate Crowdstrike, dozens of which have been created in the past few days including crowdstrike-helpdesk[.]com, crowdstrikefixer[.]com, crowdstrike[.]feedback, and more. One such campaign identified by researcher "gonjxa" targeted BBVA bank customers with a fake hotfix for connecting to BBVA during service outages. The purported hotfix contained HijackLoader and the Remcos RAT. Another campaign has been claimed by a pro-Iranian hacktivist group who declared they had impersonated CrowdStrike to distribute a data wiper