Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise

Unit 42 recently assisted a global data storage and infrastructure company that experienced a destructive ransomware attack, an incident orchestrated by Howling Scorpius, the distributors of Akira ransomware. What began with a single click on a compromised car dealership website evolved into a 42-day compromise that exposed critical gaps and allowed the attackers to access domain controllers, stage data archives with WinRAR, and pivot across multiple network boundaries.

The infection started when an employee clicked a fake CAPTCHA—a ClickFix social engineering tactic that tricked them into downloading malicious payloads and gave Howling Scorpius a foothold via SectopRAT, a .NET-based remote access Trojan. The group moved laterally using RDP, SSH and SMB, deleted the CSP’s storage backups, exfiltrated nearly 1 TB of data with FileZillaPortable, and deployed the Akira ransomware across servers in three networks.

Despite two enterprise-grade EDR tools logging the activity, very few alerts were generated, illustrating a security coverage gap between logging and active detection.