One Click, 42 Days: Akira Ransomware Used CAPTCHA Decoy to Destroy Cloud Backups and Cripple Storage Firm

The piece reports that a global data storage and infrastructure company was crippled by a destructive ransomware attack triggered by one employee’s click on a malicious CAPTCHA decoy, described in a newly released Unit 42 analysis. According to Unit 42, the attack began when an employee visited a compromised car dealership website and clicked what appeared to be a routine bot-verification prompt, a ClickFix social engineering tactic.

From that single interaction, the attackers, identified as Howling Scorpius, distributors of the Akira ransomware, launched a 42-day compromise that culminated in a corporate crisis. SectopRAT, a .NET-based remote access Trojan, was downloaded, enabling the attackers to monitor activity, steal data and execute commands, with laterally movement and access to domain controllers and massive file staging using WinRAR.

Before deploying Akira across three networks, the attackers deleted cloud storage containers holding backups and exfiltrated nearly 1 TB of data using FileZillaPortable, leaving the organisation without a safety net.