- CrowdStrike warns that it is being imitated in a malware campaign
- Crooks offer fake job postings in an attempt to deploy XMRig
- The campaign has only been active for a few days, so be aware
Hackers are impersonating well-known cybersecurity firm CrowdStrike in a malware delivery campaign, the company has warned.
In a blog post, it urged software developers to be extra careful when interacting with people online, as unidentified cybercriminals have created a fake CrowdStrike website to host malware on it.
Then they would reach out to software developers through the usual channels and offer a job position within CrowdStrike. Those who show interest are invited to download the “employee CRM application” from the website – but in reality this is a popular cryptojacker called XMRig, which mines the Monero currency for the attackers.
Why Monero?
Monero is a popular choice among cybercriminals as it is designed as a privacy coin and is relatively difficult to trace. XMRig is the most popular mining malware at the moment, found everywhere from cloud hosting servers to consumer computers. Usually, cryptominers are easy to spot as they use most of the infected device’s computing power. The computers are practically useless, which is a red flag that can be easily picked up.
However, in this case, the attackers limited the XMRig’s maximum power consumption to 10% to avoid detection. Furthermore, the malware adds a batch script in the start menu’s Startup folder to ensure that it always runs at startup.
CrowdStrike believes it hasn’t been going on too long, but fake jobs are a common occurrence on the internet these days, with the North Korean group Lazarus bringing it into the spotlight.
This organization is known for its “Operation DreamJob” campaign, which targets software developers and high-profile individuals in the technology, aerospace, defense and government industries with fake jobs.
Via Bleeping Computer
