DescriptionFortiGuard Labs is aware of the campaigns used by threat actors to spread malware, using phishing and scams to take advantage of the recent widespread global IT outage affecting Microsoft Windows hosts. This outage is due to an issue with a recent CrowdStrike update that can cause a bug check or Blue Screen of Death (BSOD) on the affected Windows machines which may get stuck in a restarting state. Why is it significant?The outage has caused many businesses’ operations to a halt worldwide across a variety of industries, including hospitals, banks, stock exchanges, and other institutions, as some Microsoft-based computers ceased to work. The threat actors have taken advantage of such events to spread malware, use phishing, and attempt other scams. What is the suggested mitigation?FortiGuards Labs recommends users to go through the vendor’s guidance to resolve the issue as soon as possible. Falcon Content Update Remediation and Guidance Hub – CrowdStrikeDo not fall victim to any phishing/scam attacks that the threat actors may take advantage of. Follow the security best practices and only use trusted sources. What is the FortiGuard Protection?All the known Indicators of Compromise (IoCs), including the File hashes, IP addresses, Domains, and URLs used by threat actors in the related campaigns are blocked by the FortiGuard Web Filtering Service.To detect and block known malware related to the associated campaigns, the FortiGuard AV signatures are available.
