US Cybersecurity Authority CISA Reports Malicious Hackers Exploiting CrowdStrike Downtime

The global network is gradually coming to life again after disruptions initiated by a significant incident at cybersecurity leader CrowdStrike brought worldwide commerce and travel to a standstill, while nefarious entities are seizing the moment to further their agendas.

The American cybersecurity body CISA remarked in a pronouncement on Friday that the interruption at CrowdStrike, which was not a result of a cyberassault or malevolent intent, did however witness a surge in malefactors attempting phishing and similar mendacious activities in its wake.

CISA issued a caution to the public to “eschew engaging with phishing emails or dubious links,” warning such actions could precipitate email breaches and various fraudulent schemes.

Malicious entities frequently leverage tumultuous events to launch cyber onslaughts, with phishing via email or SMS standing out as particularly adaptable for quick, targeted exploitation.

A cybersecurity analyst on X, the platform previously known as Twitter, reported observing phishing emails issued by bad actors using multiple domain names masquerading as CrowdStrike. One such deceptive email claimed it could rectify the “CrowdStrike apocalypse” in exchange for a substantial payment in cryptocurrency to an anonymous wallet.

In practice, the verified solutions involve either successive reboots of the compromised systems in hopes that they function long enough to download and implement the corrected update, or the manual extraction of the corrupt file from each affected unit.

Rachel Tobac, a renown social engineering authority and CEO of SocialProof Security, shared via posts on X how scammers are also utilizing the disruption to deceive people into surrendering their passwords and confidential data.

“Always confirm the authenticity of the individual’s identity before proceeding with sensitive operations,” Tobac emphasized.

Early Friday, a flawed software patch released by CrowdStrike incapacitated an immense number of Windows PCs equipped with the firm’s security solutions, leading to widespread system crashes. While CrowdStrike has remedied the glitch, they cautioned that manual interventions on each compromised device might extend the downtime.

CISA disclosed its active collaboration with CrowdStrike, governmental, and private sector partners both domestically and internationally, aiming to expedite recovery efforts.