Criminals exploit cyber blackout to distribute malware

Criminals are exploiting Friday’s cyber outage (19) as a fraud strategy. Increase in number of attempts E-fraud identified by researchers and government agencies.

HE IT outage affects machines worldwideThe issue made news almost immediately, as it led to instability (or complete inaccessibility) of essential services like airports and banks.

Criminals taking advantage of the chaos are imitating CrowdStrike to target more unwary victims, the UK’s National Cyber ​​Security Agency (NCSC) has reported.

There is an increase in the number of trials E-fraud after the power outage. Automated cybercrime monitoring company AnyRun has also seen an increase in the number of scam attempts.

The attacks aren’t just targeting businesses — hackers should also take advantage of the widespread publicity surrounding the issue to attack ordinary consumers who aren’t affected by the power outage.

AnyRun detected the distribution of HijackLoader in a supposed patch package. The malware provides remote access to the infected machine.

#Remcos RAT is presented and targeted as a fake Crowdstrike Fix @bbva bank

Source: /portalintranetgrupobbva.com
Delivered via Dropbox

C2: 213.5.130.58:443

Explosion: https://t.co/6kt15AWD36 pic.twitter.com/49dXSEvqto

— Who said what (@g0njxa) July 20, 2024

Similarly, a cybersecurity researcher at X known as @g0njxa detected a campaign focused on targeting BBVA bank embedded with Remcos, a remote access trojan (RAT).

But not every attack aims to gain access to the machines of unknowing consumers. AnyRun also detected a malware distribution that can wipe data from a computer by overwriting all local files with blank data.

Consequences of cyber outage

On Friday 19, parts of the world woke up to the blue screen of death (BSOD) on computers in essential services. Airports, banks and many companies’ terminals were completely locked down due to a buggy update in the corporate security system.

The issue was caused by the incorrect update of the Falcon system, a high-end enterprise antivirus. The error caused instability on computers and hence the error occurred in Windows.

In a post on LinkedIn, CrowdStrike says a “significant number” of affected devices have already been recovered and it works again.