Destructive Akira Ransomware Attack with a Single Click on CAPTCHA in Malicious Website

A global data storage and infrastructure company fell victim to a severe ransomware attack orchestrated by Howling Scorpius, the group responsible for distributing Akira ransomware.

The incident began with what appeared to be a routine security check on a compromised car dealership website. An employee clicked on what seemed like a standard verification prompt to prove they were human.

This single interaction triggered a 42-day compromise that exposed critical vulnerabilities in the company’s security infrastructure and demonstrated how social engineering continues to bypass even enterprise-grade defenses.

The attack leveraged ClickFix, a sophisticated social engineering tactic that disguises malware delivery as legitimate security checks.

When the unsuspecting employee interacted with the fake CAPTCHA, they unknowingly downloaded SectopRAT malware, a .NET-based remote access Trojan (RAT). This malware gave Howling Scorpius their initial foothold into the organization’s network.

Palo Alto Networks security analysts identified that SectopRAT operates in stealth mode, allowing attackers to remotely control infected systems, monitor user activity, steal sensitive data, and execute commands without detection.

The attackers established a command-and-control backdoor on a server and immediately began mapping the virtual infrastructure to plan their next moves.

Infection mechanism

The infection mechanism demonstrated the attackers’ technical sophistication. Over the subsequent 42 days, Howling Scorpius compromised multiple privileged accounts, including domain administrators.

They moved laterally through the network using Remote Desktop Protocol (RDP), Secure Shell (SSH), and Server Message Block (SMB) protocols.

The group accessed domain controllers, staged massive data archives using WinRAR across multiple file shares, and pivoted from one business unit domain into the corporate environment and eventually cloud resources.

Before deploying the Akira ransomware payload, the attackers deleted backup storage containers and exfiltrated nearly one terabyte of data using FileZillaPortable.

They then deployed Akira ransomware across servers in three separate networks, causing virtual machines to go offline and halting operations entirely. The attackers demanded ransom payment.

The incident revealed a critical security gap: while the organization had deployed two enterprise-grade endpoint detection and response (EDR) solutions that logged all malicious activities, these tools generated very few alerts.

Security logs contained complete records of every suspicious connection and lateral movement, but the lack of proper alerting left critical evidence hidden in plain sight.

Palo Alto Networks Unit 42 responded by conducting a comprehensive investigation, reconstructing the complete attack path and negotiating the ransom demand down by approximately 68 percent.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.