Akira ransomware adopts ClickFix and increased dwell time in latest observed campaign

Rafi Mahmood

Observed in the wild

• On 18 November, Unit 42 detailed an Akira ransomware attack which began with a fake CAPTCHA on a compromised car dealership website. The CAPTCHA was part of a ClickFix social engineering tactic, tricking the victim into downloading SectopRAT, a .NET-based remote access Trojan that enabled stealthy remote control.
• The attackers established a command-and-control (C2) backdoor, performed reconnaissance, and compromised multiple privileged accounts, moving laterally via RDP, SSH, and SMB. Over 42 days, they accessed domain controllers, staged large archives with WinRAR, pivoted into cloud resources, and exfiltrated nearly 1 TB of data before deploying Akira ransomware across three networks.
• Prior to ransomware deployment, the group deleted cloud storage containers holding backups and compute resources, ensuring maximum impact. The attack caused widespread operational disruption, with virtual machines going offline and ransom demands reaching the victim after full encryption.
• Organisations are advised to implement network segmentation, enforce strict privileged access controls, maintain patch maintenance, and strengthen cloud backup strategies, as well as educate users on ClckFix social engineering techniques. Continuous monitoring and properly tuned detection systems are critical to avoid blind spots that allow attackers prolonged dwell time.

Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise