Loading story…
A global data storage and infrastructure company suffered a destructive ransomware attack orchestrated by the Akira ransomware group, also known as Howling Scorpius. The attack began when an employee was tricked by a fake CAPTCHA on a compromised website, leading to the download of SectopRAT malware. This initial compromise allowed the attackers to establish a foothold, conduct reconnaissance, escalate privileges, and move laterally across the network, ultimately gaining access to domain controllers and cloud resources. Over a 42-day period, the attackers used advanced social engineering and technical tactics to evade detection and prepare for the final stage of the attack.
The attackers exploited cloud misconfigurations to destroy backups, crippling the victim's ability to recover data. The use of a CAPTCHA decoy and the targeting of cloud backups highlight evolving ransomware tactics aimed at maximizing operational disruption and ransom leverage. This incident underscores the importance of comprehensive security visibility, robust backup protection, and user awareness to defend against sophisticated, multi-stage ransomware campaigns that blend social engineering with technical exploitation.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 publicly documented the attack, describing how a fake CAPTCHA lure led to a prolonged Akira ransomware compromise. The report provided technical details on the intrusion chain and attacker behavior.
The intrusion culminated in a major ransomware impact attributed to Akira after 42 days of attacker activity in the environment. The attack crippled a storage-focused organization and followed the earlier destruction of backup resources.
During the intrusion, the attackers targeted the victim's cloud backups and storage infrastructure, undermining recovery options. This increased the operational impact and reduced the victim's ability to restore affected systems.
The attackers conducted discovery and lateral movement across the environment, escalating their reach into additional systems. Their activity enabled access to critical infrastructure and storage-related assets.
After initial access, the intruders deployed tools and established persistence to maintain access in the victim network. They used the foothold to begin internal reconnaissance and prepare for broader compromise.
A user was tricked by a fake CAPTCHA prompt into running a malicious PowerShell command, giving the attackers initial access to the victim environment. This marked the beginning of the Akira ransomware intrusion later analyzed as lasting 42 days.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders reported that **Akira ransomware** affiliates used a repeatable intrusion playbook built around stolen VPN credentials and exploitation of internet-facing appliances, including Fortinet flaws `CVE-2019-6693` and `CVE-2022-40684` and Cisco ASA/FTD flaw `CVE-2023-20269`. Recovered attacker infrastructure exposed direct evidence of reconnaissance, credential theft, and exfiltration activity, including decrypted Fortinet configurations, password-protected RAR archives containing stolen victim data, and command history showing downloads from a public-facing victim server. Investigators said the operators relied heavily on legitimate administration tools such as AnyDesk, TeamViewer, OpenSSH, MobaXterm, PowerShell, WMI, Impacket, WinSCP, FileZilla, and Cloudflared, while moving laterally through RDP and SMB and attempting to disable defenses, erase evidence, and destroy Veeam backups before encryption. Analysis of Akira’s malware and victim activity showed a **double-extortion** model that spans both Windows and Linux environments. The Linux variant supports selective path targeting, network-share encryption, partial encryption, file exclusions, and multithreaded execution using AES and RSA, dropping `akira_readme.txt` ransom notes with Tor-based contact details. Reporting also tied Akira to broad U.S.-focused targeting across sectors and suggested some operators may overlap with other ransomware-as-a-service programs, including possible links to Snatch. The group’s activity continued to affect organizations such as Texas-based **CF Supply**, where attackers were reported to have compromised corporate data that could include client project records, personal information, contracts, and agreements.
Aug 14, 2026
The **Akira** ransomware group has streamlined attacks to move from initial access to data encryption in under four hours, and in some cases in as little as one hour, according to Halcyon. Since emerging in 2023, the group has compromised hundreds of organizations and is estimated to have collected at least **$245 million** in ransom payments through September 2025. Researchers said Akira gains entry through zero-day exploits, access bought from initial access brokers, VPNs lacking multifactor authentication, and attacks on **Veeam Backup & Replication**, **Cisco VPN**, and **SonicWall** systems. The operation also uses **double extortion**, stealing data before encryption and threatening leaks, while relying on intermittent encryption and dependable decryption to increase the likelihood that victims pay. Separately, ESET identified a South American ransomware campaign that **impersonates Akira** while actually deploying a **Babuk-based** encryptor against Windows users. The malware appends the `.akira` extension to files and drops ransom notes that mimic Akira’s language and Tor negotiation links, raising the risk of false attribution. Researchers said the campaign reflects a broader pattern of threat actors reusing leaked Babuk code and borrowing the branding of established ransomware groups, underscoring the need for defenders to verify attribution through technical analysis rather than ransom-note branding alone.
Jun 29, 2026
Sophos reported that newly emerged **Akira ransomware** was deployed in two separate April 2023 attacks against organizations in North America, with victims’ files renamed using the `.akira` extension and ransom notes dropped as `fn.txt`. The company said the strain appears unrelated to a 2017 ransomware family of the same name. In one intrusion, attackers gained access to an account through **MFA bypass** activity linked to **TOR exit nodes**, dumped `LSASS` memory via `comsvcs.dll` launched with `rundll32.exe`, moved laterally over **RDP**, tampered with **Windows Defender**, installed **AnyDesk**, and launched encryption after about seven days in the environment. In the second case, attackers entered through **single-factor VPN access**, likely harvested credentials as indicated by `MEMORY.DMP`, conducted reconnaissance with **Advanced IP Scanner** and **LANSweeper** data, used **Cloudflare Tunnel** and **Radmin** for remote access, and staged data with **WinRAR** before deploying ransomware after more than 30 days. Sophos said Akira targeted a relatively narrow set of 26 file extensions, focusing largely on databases, virtual disks, and memory image files while avoiding some file types to preserve system stability, and noted that the slower pace of both operations created multiple opportunities for defenders to detect and disrupt the attacks before encryption.
Jun 29, 2026