Callback Malware Campaigns Impersonate CrowdStrike and Different Cybersecurity Corporations

CrowdStrike despatched the next Tech Alert to their prospects 

On July 8, 2022, CrowdStrike Intelligence recognized a callback phishing marketing campaign impersonating distinguished cybersecurity firms, together with CrowdStrike. The phishing e-mail implies the recipient’s firm has been breached and insists the sufferer name the included telephone quantity. This marketing campaign leverages comparable social-engineering ways to these employed in current callback campaigns together with WIZARD SPIDER’s 2021 BazarCall marketing campaign.

This marketing campaign will extremely seemingly embody widespread authentic distant administration instruments (RATs) for preliminary entry, off-the-shelf penetration testing instruments for lateral motion, and the deployment of ransomware or information extortion.

Particulars

The callback marketing campaign employs emails that seem to originate from distinguished safety firms; the message claims the safety firm recognized a possible compromise within the recipient’s community. As with prior callback campaigns, the operators present a telephone quantity for the recipient to name (Determine 1).

Traditionally, callback marketing campaign operators try to influence victims to put in business RAT software program to achieve an preliminary foothold on the community. For instance, CrowdStrike Intelligence recognized an analogous callback marketing campaign in March 2022 by which risk actors put in AteraRMM adopted by Cobalt Strike to help with lateral motion and deploy further malware. 

Evaluation

Whereas CrowdStrike Intelligence can’t at present affirm the variant in use, the callback operators will seemingly use ransomware to monetize their operation. This evaluation is made with reasonable confidence, as 2021 BazarCall campaigns would ultimately result in Conti ransomware — although this ransomware-as-a-service (RaaS) lately ceased operations. That is the primary recognized callback marketing campaign impersonating cybersecurity entities and has greater potential success given the pressing nature of cyber breaches.

CrowdStrike won’t ever contact prospects on this method.

Any prospects receiving an e-mail akin to these on this Alert ought to ahead phishing emails to csirt@crowdstrike.com. 

KnowBe4 wish to add that virtually no cybersecurity firm would warn their prospects this manner, so coaching your workers to acknowledge social engineering assaults like it is a should.

It is a crosspost from the Crowdstrike weblog, with grateful acknowledgements.