On July 19, 2024, a content update from cybersecurity vendor CrowdStrike triggered a widespread Blue Screen of Death (BSOD) event impacting Windows machines globally. Microsoft estimates that approximately 8.5 million systems were affected. The company has since released a recovery tool to assist impacted customers.

Capitalizing on this disruption, malicious actors have launched phishing campaigns and deployed malware disguised as CrowdStrike hotfixes. Security researchers and threat intelligence providers, including McAfee, have identified numerous suspicious domains registered since the incident.

To mitigate any further disruption, international security regulatory bodies such as CISA and CERT-In have issued advisories urging users to remain vigilant and avoid clicking on links or downloading attachments from untrusted sources.

  Currently, the below malicious domains associated with the CrowdStrike incident have been identified by the threat intel sources.

• crowdstrikebug.com

• crowdstrikefail.com

• crowdstrikeoopsie.com

• crowdfalcon-immed-update.com

• supportfalconcrowdstrikel.com

• crowdstrikeclaim.com

• crowdstrike0day.com

• crowdstrikedoomsday.com

• crowdstrikedown.site

• crowdstrike-helpdesk.com

• sinkhole-d845c7b471d9adc14942f95105d5ffcf.crowdstrikeupdate.com

• crowdstrikeoutage.com

• isitcrowdstrike.com

• crowdstrikefix.zip.com

• crowdstrike-cloudtrail-storage-bb-126d5e.s3.us-west-1.amazonaws.com

• crowdstrikereport.com

How can ManageEngine help you stay secure after the CrowdStrike meltdown 

ManageEngine Log360 Cloud partners up with several reputed threat intelligence platforms and threat intel providers like Webroot and VirusTotal to maintain a centralized threat feed repository. This repository gets auto-updated dynamically, and helps you detect and proactively search for indicators of compromise (IoCs) linked to attacks exploiting the CrowdStrike incident. Log360 Cloud equips you to stay ahead of these attempts, even if your organization hasn't been directly affected by the CrowdStrike disruption.

 Check out part 2 for the step-by-step instructions.