Timeline

_

of

_

the

_

Crowdstrike

_

Windows

_

update

_

bug

_

and

_

its

_

consequences

Phishing and Malware

Attackers launched phishing campaigns impersonating official communications from CrowdStrike, tricking users into downloading malicious files. These files, disguised as security updates, actually installed malware such as RemCos, a remote access trojan (RAT) that allows attackers to take control of the infected system.

Typosquatting

Multiple fraudulent domains were registered, mimicking legitimate CrowdStrike websites. These domains were used to distribute malware or collect credentials from unsuspecting users.

Vishing

In addition to email phishing, attackers used phone calls and other forms of communication to impersonate CrowdStrike support staff, attempting to obtain confidential information or convince users to install harmful software under the premise of resolving issues related to the CrowdStrike failure.

Data Wipers and Ransomware

Some attackers deployed data-wiping tools and ransomware, taking advantage of the confusion caused by the CrowdStrike failure. These attacks aimed not only to steal information but also to cause significant damage to the affected organizations.