CrowdStrike Outage: Official Remediation Resources and Guidance
The recent CrowdStrike and Microsoft outage impacted millions of devices globally. Both companies have now released official guidance and tools to fix the issue. Learn more about the resources and cybersecurity threats arising from the incident.
- CrowdStrike and Microsoft have issued official remediation tools and guidance to fix devices impacted by the recent global outage.
- While Microsoft has released a dedicated Windows repair tool designed to remove the problematic driver, CrowdStrike has set up a dedicated hub offering remediation guidance, updates, and best practices.
The recent CrowdStrike/ Windows outage impacted users worldwide, with over 8 million devices going down, at least temporarily. While most users had to resort to manual fixes, IT teams were under pressure to keep systems running. Now, Microsoft and CrowdStrike have released guidance and tools to help organizational admins and users navigate the challenges brought about by CrowdStrike’s faulty update.
Here, we provide an overview of the official resources available to fix the outage and discuss the importance of only using verified sources to minimize the impact of exploits cyber criminals have been using since the outage began.
See More: Falcon Sensor Product Update Creates Outages for Microsoft Users Worldwide: An Analysis
Microsoft’s Outage Resources
Microsoft has released a dedicated repair tool for Windows to remove the faulty CrowdStrike driver that caused the system crashes. The tool is designed for IT administrators and can be used to repair affected devices through USBs.
Microsoft’s recovery tool makes the recovery process more manageable by booting the Windows PE environment via USB. This allows users to access the affected disk and automatically deletes the problematic CrowdStrike file so the machine can boot appropriately without needing admin rights or booting into Safe Mode. It can be accessed here.
Further, Microsoft’s official blog has provided detailed stepwise guidelines for users to understand the problem and use the recovery tool, as well as guidance to ensure that systems are updated to prevent future problems. You can access the blog post here to get accurate and latest information directly from Microsoft.
CrowdStrike’s Outage Resources
CrowdStrike has set up a dedicated hub that provides Windows users with updates, remediation guidance, and best practices to mitigate the incident’s impact. The page includes technical information about the outage, the affected systems, and a statement by CEO George Kurtz.
CrowdStrike frequently updates this information hub and is also the primary source for data on resolving the problems arising from the outage. Users can access the latest data about the CrowdStrike update and related fixes here.
Exploits and Scam Threats
Cybercriminals have been exploiting the outage, distributing malware, and running phishing scams under the pretext of providing updates or fixes. Consequently, IT administrators and users must exercise additional vigilance and rely only on official sources for remediation tools and guidance.
CrowdStrike has warned that threat actors are distributing Remcos RAT to users in Latin America in a ZIP archive file named crowdstrike-hotfix.zip, which contains a malware loader. The RAT is installed under the pretext of launching a fix for the outage.
Security researchers have also noted a rise in CrowdStrike-themed domain registrations. Such websites could trick users into downloading malicious code or revealing private information. Furthermore, the UK National Cyber Security Center (NCSC) warned that it has observed an increase in phishing messages aimed to exploit the outage.
Threat intelligence platform FalconFeeds has also reported that Palestinian hacktivists have launched a phishing campaign against Israel-based organizations that use CrowdStrike to install malware in their systems. This highlights the use of the outage for cyberwarfare objectives.
Takeaways
In light of the Microsoft/CrowdStrike outage, users and IT administrators must stay updated with the official information channels. Both companies have provided tools and guidance that can adequately minimize the impact of the incident and restore systems with minimal downtime.
It is also vital for individuals and organizations to be vigilant about potential exploits and scams and ensure that any action taken for system recovery is based on official, verifiable sources.
LATEST NEWS STORIES
