Executive Summary
On July 19, 2024, a sudden outage affected a majority of primarily Microsoft devices following an update issued by CrowdStrike. Initial inability to identify the root cause of this sudden outage, resulted in a significant halt in global operations across a wide range of industries. According to a BBC report, approximately 8.5 million Windows hosts were frozen from day-to-day activities, and the severity of issues caused in medical, aviation, and other emergency
reasons was beyond imagination.
Following the recent update incident affecting Microsoft computers, malicious actors have registered various domains and typo squats targeting CrowdStrike, exploiting the situation for malicious purposes. These domains are often crafted to resemble legitimate CrowdStrike addresses, intending to deceive users into divulging sensitive information or installing malware.
The motives behind the actions taken by these malicious actors range from financial gain through phishing and fraud to causing reputational damage to CrowdStrike by associating it with the fallout from the Microsoft incident. Additionally, some domains were registered to mock the situation, further amplifying the negative publicity and adding to the reputational risk.
Campaign Analysis
Correlation and Patterns Identified
The majority of domains include “CrowdStrike,” suggesting a direct attempt to impersonate or associate with the official CrowdStrike brand. Words like “fail,” “down,” “sucks,” “oops,” “bug,” “error,” “glitch,” “classaction,” “lawsuit,” “recovery,” and “fix” are recurrent. These terms indicate a focus on exploiting perceived failures or issues, likely to undermine CrowdStrike’s reputation and incite fear or frustration among users.
Variations such as “crowstrike,” “croudstrike,” and “crowdstriked” indicate typosquatting tactics aimed at capturing traffic from users who misspell the domain name. In addition, terms like “bluescreen,” “BSOD” (Blue Screen of Death), “kernel,” and “0day” (zero-day vulnerabilities) suggest a narrative of severe technical failures and exploits.
Domains incorporating “helpdesk”, “support”, “fix”, “repair”, “rescue”, and “mend” indicate an attempt to pose as technical support or issue resolution services, likely for phishing or fraud. Domains such as “classaction” and “claims” imply attempts to spread misinformation or capitalize on potential legal fears.
Many domains are designed to mimic legitimate CrowdStrike services, aiming to deceive users into believing they are interacting with the official site. By highlighting terms associated with errors, failures, and legal issues, these domains aim to exploit user concerns and drive traffic through fear. The use of support and help-related terms suggests an intent to trick users into providing sensitive information under the guise of technical assistance. Some domains
appear to mock the situation (like “CrowdStrikeoops”, “CrowdStrikeoopsie”, and “CrowdStrikesucks”), potentially adding to the reputational damage.
Conclusion
