Likely eCrime Actor Capitalizing on Falcon Sensor Issues
Essential information
- Published
- 29/07/2024 12:16
- Modified
- 29/07/2024 12:34
- Tags
- 2024-07-29 falcon hijackloader latam phishing remcos
- Related entities
- 14 observables, 7 techniques (mitre), 2 malware
Description
A cybercrime group has leveraged a content update issue with the CrowdStrike Falcon sensor to distribute malicious files targeting Latin American customers. The campaign involves a ZIP archive named 'crowdstrike-hotfix.zip' containing a HijackLoader payload that loads RemCos malware, using Spanish filenames and instructions, indicating it specifically aims at CrowdStrike clients in that region.