Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise

Unit 42 responded to a 42-day compromise at a global data storage company in which Howling Scorpius (Akira ransomware operators) used a ClickFix fake CAPTCHA to deliver SectopRAT, gained privileged access, moved laterally via RDP/SSH/SMB, exfiltrated ~1 TB of data, deleted backup storage, and encrypted systems across three networks; Unit 42 deployed Cortex XSIAM to reconstruct the attack, negotiated with the actors to reduce the ransom, and provided remediation and strategic recommendations including segmentation, credential rotation (KRBTGT), improved detection, and hardened cloud/endpoint practices.