Currently a callback campaign employs emails that appear to originate from cyber security companies. To bait the hook the message claims a potential compromise in the recipient’s network was detected. The operators provide a phone number for the recipient to call back. CrowdStrike warns that the callers will highly likely talk victims into installing legitimate remote administration tools, as in a March 2022 campaign that installed AteraRMM followed by Cobalt Strike, and assesses with moderate confidence that ransomware comes next. BleepingComputer reports that AdvIntel attributes the CrowdStrike-themed lure to the Quantum ransomware gang, which runs its own take on Conti’s BazarCall playbook. Pro tip: a real incident responder will not cold-email you a phone number.
