It is important to note that the CrowdStrike/Microsoft outage was NOT a cyberattack. The incident began with a software update. As part of its ongoing threat protection, CrowdStrike regularly updates its sensor with the latest threat data. In this instance, the update violated a protected memory address within the Microsoft Windows environment, causing the operating system to encounter a critical error, resulting in the ubiquitous “blue screen of death” where an affected device is unable to recover on its own. 

The workaround to the issue involved a very manual process, requiring users/admins to log in to each machine under “safe mode” and remove the registry key that contains the faulty code. This event shows just how connected technology products are within our ecosystem, and one failure can cause a cascade of devastating impact on an entire infrastructure. 

While both CrowdStrike and Microsoft are working diligently to assist in recovery efforts, we all need to be aware of the potential for secondary attacks from cybercriminals based on information collected via a phishing attack.

Within hours of the incident on July 19, 2024 CrowdStrike warned of malicious activity trying to exploit the outage. One primary method that cybercriminals are using is to send phishing emails purportedly from CrowdStrike (or Microsoft) using “spoofed” addresses (i.e., somebody@crowdstrikeoutage.com) with malicious attachments or simply to gather information for a later compromise. 

CrowdStrike and Microsoft are working around the clock to provide guidance as well as potential tools to assist with recovery. Some good, free advice: DO NOT OPEN any emails from unofficial addresses posing as CrowdStrike or Microsoft support and thoroughly questioning any potential phone calls you may get from CrowdStrike staff; they are likely impersonators. 

Additionally, this unfortunate incident opens up the conversation for developing (or revisiting) a robust cybersecurity prevention and recovery plan. With access to a breadth of cybersecurity providers, solution architects, and managed services, Cloud 9 has the opportunity to help you with your entire strategy – from organization-wide cyber training, to IT outage response plans, to infrastructure automation for disaster recovery, to third-party risk management and consulting programs. 

Or, if you’re a maverick and really want to stir the pot, we can even help you switch it all over to Google and Chromebooks!

Note: We are not reporters, regardless we thought this story important enough to share. We've pieced together this article from a few other (hopefully) reputable stories, sources, and reports. We'll try to keep things updated appropriately

Starting Thursday evening July 18, 2024 and coming to a head on Friday, Microsoft experienced a significant global outage, affecting services such as Office 365, Azure, and Teams - but seemingly and mostly attributed to Microsoft Windows. This disruption impacted businesses worldwide, halting operations and causing widespread frustration among users and consumers alike. According to Wired, the root cause of the outage was identified as an issue linked to CrowdStrike's security software, which is integrated into Microsoft's infrastructure for enhanced cybersecurity measures

https://www.wired.com/story/microsoft-windows-outage-crowdstrike-global-it-probems/

Initial investigations revealed that a recent update to CrowdStrike's Falcon platform inadvertently triggered a cascade of failures within Microsoft's systems. This apparently routine update, meant to enhance security features, instead led to serious unexpected system incompatibilities and undesired behavior. The BBC reports that the issue was severe enough to cause cascading failures across Microsoft's global network, demonstrating the interconnected nature of modern IT ecosystems