Akira Intrusion Used ClickFix to Gain Domain Admin and Encrypt 485,224 Files

Oct 14, 2026 · Original article ↗

Summary

A 19-day Akira-family intrusion began with a ClickFix prompt and ended with 485,224 files encrypted. Investigators traced credential access, persistence, 336 GB of exfiltration and encryption from an attacker-built VM.

Key points

An engineer ran a command pasted from a compromised sports camp website’s ClickFix overlay, launching a PowerShell script and a recurring scheduled task.
Two days later, a PowerShell LDAP query requested every user’s Description and comment attributes. Investigators assessed credential recovery from those fields as probable, but found no credential-dumping tool.
The operator used valid credentials to reach Domain Administrator access, enabled SQL Server’s xp_cmdshell, created accounts and backdoored a storage appliance.
After connectivity was restored, the operator deleted backups and exfiltrated about 336 GB over FTPS.
The attacker created an unmonitored VM, stopped six production VMs and attached their virtual disks. The encryptor ran against 12 mounted volumes while the victim systems and their security agents were offline.
Investigators attributed the activity to the Akira family with moderate confidence; they could not identify a specific affiliate.
The report recommends auditing directory free-text fields for credentials, removing attacker access before restoring connectivity, and monitoring scheduled tasks, SQL configuration changes and virtual-disk attachments.

Article Details

Attack Vectors: A compromised legitimate sports camp website displayed a ClickFix overlay that induced an engineer to paste and execute a command in the Windows Run dialog.
The obfuscated PowerShell launcher downloaded and executed a second-stage script. A hidden scheduled task maintained execution under the logged-on user's account every forty minutes.
An LDAP query enumerated domain users and requested Description and comment attributes. Credential recovery from these fields is assessed as probable, not confirmed: the query output was deleted, and subsequent authenticated activity supports the assessment.
An authenticated SQL session enabled advanced options and configured xp_cmdshell. Subsequent operating-system command execution and creation of an unauthorized local account through this channel are assessed as probable.
Valid administrator credentials enabled access to the management server, hypervisor and storage appliance. The operator re-enabled a dormant appliance administrator account, changed its password and obtained root access through SSH.
Attacker accounts and persistence survived an approximately two-week internet disconnection, leaving access routes available after connectivity returned.
The operator deleted backups, archived file shares and exfiltrated approximately 336 GB over FTPS before encrypting the storage appliance.
The operator stopped six production VMs, attached their virtual disks to an attacker-built VM without a security agent and ran one encryptor against twelve lettered volumes. Three Windows servers had their files encrypted while their operating systems were offline.
Defensive Notes: Treat unexpected instructions to paste commands into Run dialogs or terminals as suspicious. Apply application control and appropriate PowerShell restrictions; disable the Run dialog where unnecessary.
Audit readable directory attributes, including Description, comment, info and custom account-note fields, for exposed secrets. Remove exposed passwords, rotate them and change account-management practices; use gMSAs where supported.
Keep xp_cmdshell disabled unless required, monitor configuration changes and restrict SQL service-account privileges. A configuration-change record alone does not establish that the change was applied or an operating-system command executed.
Investigate authentication failures against source-specific historical baselines and correlate them with nearby account changes, SQL configuration changes and successful logons.
Avoid domain-joining storage appliances where practical. Restrict appliance administrative membership and monitor dormant local-account reactivation and password changes.
Restrict production VM creation and virtual-disk attachment to authorized administrators. Investigate unexpected disk attachments and rapid shutdowns of multiple VMs.
Remove attacker accounts, scheduled tasks and other persistence, and remediate compromised credentials before restoring connectivity. Deleting a task's payload does not remove the task.
Enable command-line process-creation auditing and PowerShell script-block logging on servers and workstations. Preserve sufficient authentication-log retention.
Check appliance-specific command logs and centralized syslog even when shell-history files have been cleared. In this incident, a separate command log preserved the backdoor installation and cleanup commands.
Treat cached credentials on the encrypted servers as potentially exposed. Filesystem evidence established encryption of credential stores, not whether the operator read them beforehand.
The supplied detection recipes are illustrative hunting hypotheses, not validated production rules; map fields to local telemetry and test legitimate and suspicious activity before alerting.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`jackhammerable[.]net`	Beacon C2 domain contacted over TCP port 443.
DOMAIN	`nationwidely[.]net`	Attacker domain from which the ClickFix PowerShell launcher fetched the second-stage script.
IPV4	`162[.]243[.]64[.]221`	Attacker HTTP staging host used to deliver the storage-appliance backdoor on Day 2.
IPV4	`45[.]157[.]118[.]82`	Address to which the beacon C2 domain resolved during the intrusion.
IPV4	`80[.]240[.]17[.]24`	Attacker host used for Linux encryptor delivery over HTTP on port 8080 and FTPS exfiltration on port 443.
IPV4	`88[.]80[.]150[.]25`	Address to which the beacon C2 domain resolved during the intrusion.
SHA256	`8914d0e5d54a648ff2457e44d4bcdd235f484c45033c2a06cbd77471faf3df61`	SHA256 of the recovered beacon script; the source cautions that it may identify only this host's sample.