HKCERT Urges the Public to Beware of Malware Attacks by Hackers Exploiting the Recent CrowdStrike Software Update Failure Incident

(Hong Kong, 24 July 2024) Regarding the CrowdStrike software update failure incident on 19 July 2024, Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) found reports that criminals continue to evolve their attack tactics. Those include using fake CrowdStrike recovery manuals, fake remediation solutions and fake software updates to deliver unidentified malware, which could lead to sensitive data leakage, system crashes, and data loss.

According to related information, HKCERT has observed the following attack tactics to spread malware that are taking advantage of this incident.

Fake recovery manual

• A new type of malware is spreading through Word documents that contain macros. These documents pretend to be Microsoft recovery guides to trick people into opening them. Once opened, the macros activate and start stealing sensitive information like passwords. This stolen information is then sent to the attacker's server.

Fake remediation solutions

• Through phishing sites and fake intranet portals to promote fake CrowdStrike hotfix. Fake hotfix delivered a malware loader then dropped a remote access tool that can be controlled by hackers on the infected system.

Fake CrowdStrike update

• Phishing emails included a link to download a ZIP file that contained an executable named 'Crowdstrike.exe'. After being executed, "data wiper" was extracted to a folder under "%Temp%" and launched to destroy data stored on the device.

HKCERT urges the public to be vigilant against the malware attacks and recommends that users should:

• Apply remediation methods provided by official websites (Such as remediation methods provided by CrowdStrike)）
• Obtain software patch update from trusted source (Such as recovery tool provided by Microsoft)）
• Check website certificates on download page to ensure legitimate source, avoid executing files from untrusted source.
• Use browser settings to enable download protection which can issue warnings about potentially harmful websites or downloads.
• Use the free search engine “Scameter” of Cyberdefender.hk to identify frauds and online pitfalls through email, URL or IP address, etc.

If the public encounter a malware attack, HKCERT recommends that users should:

• Immediately disconnect from the network to prevent further spread of the malware
• Conduct a comprehensive system scan to identify and remove any malicious software
• Restore from a backup (such as an external hard drive) to recover lost or compromised data
• Install security software to safeguard against future attacks

To learn more about the security advisory of CrowdStrike denial of service alert, please visit the HKCERT website for the latest news:

https://www.hkcert.org/tc/security-bulletin/crowdstrike-denial-of-service-vulnerability_20240719

Businesses or members of the public who wish to report to HKCERT on cyber security related incidents can do so by completing the online form at: https://www.hkcert.org/zh/incident-reporting or call the 24-hour hotline at 8105 6060. For further enquiries, please contact HKCERT at hkcert@hkcert.org.

- Ends -