Full Report
Three of the Windows servers were switched off when their files were encrypted. By the end of this nineteen-day intrusion, 485,224 files had been encrypted. Stoïk CERT investigated the incident at a mid-sized European engineering consultancy. It began on an engineer's work laptop, after a visit to a compromised sports camp website. Following a ClickFix prompt, the engineer pasted a command into the Windows Run dialog. Two days later, the operator queried the directory for users' Description and comment attributes. Domain Administrator access followed thirty-eight minutes after that query. We assess credential recovery from those fields as probable: the output had been deleted, but the timing and subsequent authenticated activity support that explanation. We found no credential-dumping tool in the available evidence. The final encryption ran in a VM the attacker had built. After stopping six production VMs, the operator attached their disks to it and ran one encryptor against twelve mounted volumes. The security agents inside the powered-off victims could not observe the execution. The investigation drew our attention to readable directory attributes and to the control a compromised hypervisor gives an attacker over virtual disks. Both deserve a place in an incident response plan.
Analysis Summary
# Incident Report: Akira Ransomware Intrusion via ClickFix
## Executive Summary
A mid-sized European engineering consultancy suffered a 19-day Akira-family ransomware intrusion resulting in the encryption of nearly 500,000 files. The attack originated from a "ClickFix" social engineering tactic on a compromised website, leading to Domain Administrator privileges through the exploitation of readable Active Directory attributes. The attackers bypassed endpoint security by mounting victim virtual disks to an attacker-controlled VM for encryption.
## Incident Details
- **Discovery Date:** Day 19 (Final encryption phase)
- **Incident Date:** Day 0 through Day 19
- **Affected Organization:** Redacted European engineering consultancy
- **Sector:** Engineering / Consultancy
- **Geography:** Europe
## Timeline of Events
### Initial Access
- **Date/Time:** Day 0, 15:59 UTC
- **Vector:** ClickFix (Social Engineering)
- **Details:** An engineer visited a compromised sports camp website. A prompt instructed the user to paste a malicious command into the Windows Run dialog, which registered a persistent scheduled task running a PowerShell beacon every 40 minutes.
### Lateral Movement
- **Day 2:** The attacker performed an LDAP query for all user `Description` and `comment` fields.
- **Day 2:** 38 minutes later, the attacker gained Domain Admin access, likely by harvesting plaintext credentials stored in those AD fields.
- **Day 2:** Attacker enabled `xp_cmdshell` on a backup SQL instance and created a local account `itadm`.
- **Day 2:** Attacker re-enabled a dormant local `admin` account on a storage appliance via a web console session.
### Data Exfiltration/Impact
- **Day 18:** 336 GB of data exfiltrated via FTPS; backups were deleted and NAS encrypted.
- **Day 19:** Final encryption phase. 485,224 files encrypted across 12 volumes.
### Detection & Response
- **Day 3:** Client disconnected internet access at all sites (Initial suspicion).
- **Day 16-19:** Attacker returned after connectivity restoration to complete the objective.
- **Post-Incident:** Stoïk CERT conducted forensic analysis of the hypervisor and AD logs.
## Attack Methodology
- **Initial Access:** ClickFix / PowerShell command injection.
- **Persistence:** Scheduled task (10-year duration, 40-minute interval) running a hidden PowerShell script in `C:\ProgramData\`.
- **Privilege Escalation:** Exploitation of credentials found in Active Directory user attributes (`Description`/`comment`).
- **Defense Evasion:** Overwriting shell history; mounting disks to an external VM to bypass security agents on the victim servers.
- **Credential Access:** AD attribute harvesting; re-enabling dormant local accounts on appliances.
- **Discovery:** LDAP queries for directory attributes.
- **Lateral Movement:** Authenticated RDP/SSH and SQL command execution (`xp_cmdshell`).
- **Exfiltration:** FTPS (File Transfer Protocol Secure).
- **Impact:** Akira Ransomware; deletion of backups.
## Impact Assessment
- **Financial:** Significant (Costs associated with 19-day intrusion and recovery).
- **Data Breach:** 336 GB exfiltrated; 485,224 files encrypted.
- **Operational:** Six production VMs and NAS storage taken offline; 12 volumes encrypted.
- **Reputational:** High risk given the nature of consultancy services.
## Indicators of Compromise
- **Files:** `C:\ProgramData\<random>.ps1`, `C:\programdata\sentinel2.log` (LDAP dump).
- **Accounts:** `itadm` (Local), `backupadmin` (Appliance/Hypervisor).
- **Behavioral:**
- `powershell.exe` with `ExportedCommands` and `IPMO`.
- SQL Event ID 15457 (`xp_cmdshell` enabled).
- Unrecognized virtual disks attached to hypervisors.
## Response Actions
- **Containment:** Infrastructure isolation (Internet kill-switch).
- **Eradication:** Deletion of unauthorized local accounts; removal of malicious scheduled tasks.
- **Recovery:** Restoration of services after forensic investigation into the hypervisor compromise.
## Lessons Learned
- **AD Hygiene:** Storing credentials in free-text AD fields (Description/Comments) is a critical vulnerability.
- **Hypervisor Security:** If a hypervisor is compromised, security agents inside guest VMs are ineffective if the disks are mounted elsewhere.
- **Social Engineering:** User training failed to prevent the execution of untrusted commands via the Run dialog.
## Recommendations
1. **Audit Active Directory:** Immediately sweep all user attributes for plaintext passwords.
2. **Restrict SQL Permissions:** Disable `xp_cmdshell` and alert on any configuration changes to SQL "advanced options."
3. **Hypervisor Hardening:** Implement MFA for hypervisor management consoles and monitor for "Disk Attach" events.
4. **Endpoint Protection:** Block execution of PowerShell from common staging areas like `C:\ProgramData\`.