Global IT Disruption from CrowdStrike Outage Exploited by Cybercriminals for Phishing and Malicious Activities

Global IT Disruption from CrowdStrike Outage Exploited by Cybercriminals for Phishing and Malicious Activities
Image credit: The Express Tribue

As businesses worldwide recover from an IT outage caused by CrowdStrike, cybercriminals are exploiting the chaos for their own gain. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning that while the CrowdStrike outage was not due to a cyberattack, threat actors are leveraging the situation to conduct phishing and other malicious activities.

CISA advised the public to avoid clicking on phishing emails or suspicious links, which could lead to email compromise and other scams. Security researchers have already observed phishing emails impersonating CrowdStrike, falsely claiming to offer fixes for the outage in exchange for payment to a cryptocurrency wallet.

The genuine solutions involve either restarting affected computers repeatedly until the fixed update installs or manually removing the defective file from each computer. Social engineering expert Rachel Tobac emphasized the importance of verifying identities before taking sensitive actions, noting that criminals will use the outage to trick victims into revealing passwords and other sensitive information.

The outage began early Friday when a defective software update from CrowdStrike caused numerous Windows computers running its security software to crash. Although CrowdStrike has fixed the bug, the need for manual remediation means that some outages may persist. CISA is working closely with CrowdStrike, federal and local partners, and international entities to assist with the resolution.