Chaos as a Smokescreen: Malware Deployed as CrowdStrike Updater

These outages, whether planned or accidental, create a vulnerable window that attackers are increasingly exploiting. This blog will dive into the newest trend in cybercrime: leveraging IT outages to deploy malware, and offer insights into how organizations can protect themselves.

Introduction

Cybercriminals have taken advantage of the recent IT outage, using the chaos as a smokescreen to deploy the malicious data wiper known as HatefWiper disguised as a CrowdStrike Updater. These outages can occur due to various reasons such as system updates, hardware failures, or unexpected power cuts. During these periods, security measures may be relaxed, and systems might be temporarily down or in a rebooting state, creating a gap in defenses that cybercriminals can exploit.

Cybercriminal Strategies During IT Outages

Cybercriminals have developed sophisticated methods to take advantage of periods of vulnerability during IT outages. These tactics exploit the temporary lapses in security and the urgency to restore normal operations, increasing the likelihood of successful malware deployment. Here are some of the primary strategies:

Phishing Attacks

Within hours of the disruption, phishing emails mimicking CrowdStrike support began circulating. These emails urged recipients to download fake "hotfix" updates to resolve the BSOD issue. Unsuspecting users who followed these instructions ended up installing malware instead. These malicious updates appeared highly convincing, often mimicking official communications from CrowdStrike.

In our previous blog, we highlighted some of the newly created domains that can and may be used for phishing attacks.

Malicious Updates

Attackers used these fake updates to deploy various types of malware, including Remote Access Trojans (RATs) like Remcos, and even data wipers designed to destroy data on infected systems. For instance, a phishing site masquerading as an internal portal for BBVA bank distributed a fake CrowdStrike hotfix that installed Remcos RAT, granting attackers remote access to compromised systems.

CrowdStrike Updater Analysis: Chaos as a Smokescreen

We have a sample of the CrowdStrike.exe updater that we will be examining for this section. The malicious malware is included in a zip package called "update.zip" which cybercriminals utilized to take advantage of the current turmoil and trick users into fixing their endpoint’s BSOD (blue screen of death) issue.

The following instance notifies the user that an update is currently underway through a message box that appears upon execution.

Network Traffic

While monitoring network activity, we discovered that this sample tried to connect to certain IP addresses and the domain name "XLuvBdVPcngNKMPfoEAAut.XLuvBdVPcngNKMPfoEAAuT" which is related with HatefWiper malware. We also noticed that this virus communicates to a nonstandard port, 1900, which is generally used for UPNP. If this port is accessible, programs can request dynamic incoming port forwarding, which malware can use to get access to your machine via the internet—a common botnet configuration. This introduces an easily exploited security flaw for any network-connected machine.

A record of suspicious activity regarding with the IP addresses used by EnemyBot malware, an IoT botnet used for DDoS attacks.

Process and File Creations

After running the sample, we discovered that a "cmd.exe" process was launched, which performed multiple commands, including combinations of "tasklist.exe" and "findstr.exe". Before executing, the sample was scanned for popular antivirus software names. This approach is often used in malware for discovery and impairing defenses.

It also creates multiple files in the "%localappdata%\Temp" path, including a directory containing several interesting binaries named "Champion.pif" with an odd file extension; it turns out that this file is a program that converts scripts into standalone.exe files. AutoIt Downloads - AutoIt 

AutoIt.exe masquerading as “Champion.pif” binary.

Sigma Rules

Sigma rules are a powerful tool for threat detection and response. These rules offer a standardized way to define search patterns for various security events, making it easier to detect and respond to threats across different SIEM (Security Information and Event Management) systems.

We have created sample Sigma rules for HatefWiper’s aka CrowdStrike updater IOCs.

CrowdStrike Updater - ‘cmd.exe' use cases detection sigma-rules/T1082.T1057!CrowdStrikeUpdater/Sigma-CMD-Redirect.yml at main · SecurityBlueTeam/sigma-rules

CrowdStrike Updater - ‘tasklist.exe' use cases detection sigma-rules/T1082.T1057!CrowdStrikeUpdater/Sigma-Tasklist-Redirect.yml at main · SecurityBlueTeam/sigma-rules

CrowdStrike Updater - ‘findstr.exe' use cases detection sigma-rules/T1082.T1057!CrowdStrikeUpdater/Sigma-Findstr-Recon.yml at main · SecurityBlueTeam/sigma-rules

Endpoint IOCs

Network IOCs

Conclusion

These outages are unpredictable. In today’s world, we heavily rely on new technologies and their implementations, maximizing tool capabilities. We often forget that these technologies are still operated by human expertise. Humans are vulnerable to making mistakes, and this vulnerability is often exploited by cybercriminals for their own agendas.

Let's use this event—the latest global outage that delayed flights and brought hospitals and other organizations to their knees—to become more aware of the lurking threats waiting to exploit such situations. As a team, we want to contribute to this quick research on some of the malware being deployed while mimicking helpful software. To our CrowdStrike folks, who experience no weekends, sleep, or important family gatherings just to help mitigate this incident. We salute you.

To organizations: Be aware and put proper controls and detection in place to avoid further damage. To all people: As we globally share this issue, with millions being affected, we must practice the shared responsibility model. Help as you can. In these times, it is more important to put our heads down, work, and contribute rather than point fingers. Cheers!

If you found this topic fascinating and want to dive deeper into understanding this malware, Blue Team Labs Online offers an exciting lab called StrikeCrowd. Here, you'll get the chance to analyze this sample firsthand. Challenge yourself and see what you can uncover! Simply log in or sign up for a BTLO account today to get started! 

Contributors

Renmarc Andrada, Defensive Content Engineer

Malik Girondin, Defensive Content Engineer

Luis Suastegui, Junior Defensive Content Engineer

References

Fake CrowdStrike fixes target companies with malware, data wipers

CrowdStrike Releases Fix for Updates Causing Windows to Enter BSOD Loop

Automated Malware Analysis Report for CrowdStrike.exe - Generated by Joe Sandbox

https://bazaar.abuse.ch/sample/19001dd441e50233d7f0addb4fcd405a70ac3d5e310ff20b331d6f1a29c634f0

About SBT

Security Blue Team is a leading online defensive cybersecurity training provider with over 100,000 students worldwide, and training security teams across governments, military units, law enforcement agencies, managed security providers, and many more industries.