Berlin Ransomware Attack Traced to Fake CAPTCHA TerminalFix Lure

Executive Summary

A Berlin ransomware attack that leaked data from two state government departments began with a fake CAPTCHA, according to Germany’s Federal Office for Information Security (BSI). The BSI has tied the intrusion to TerminalFix, a ClickFix-style campaign that tricks a user into pasting a malicious command into their own Windows computer. The Rhysida group demanded 30 bitcoin. Berlin refused and 1.4 million records were published on the dark web after the deadline passed. On 16 October 2026 the Senate Chancellery said the immediate threat had been averted while analysis of the stolen data continues. In Sweden, code planted on the website of Officerstidningen, the officers’ union magazine, tried a similar trick on visitors in late August.

Inside the Berlin Ransomware Attack: One Pasted Command

The BSI said in a security notice dated 4 September 2026 that it had been told in August about a compromised network at a state institution. Its analysis found the sequence of events matched TerminalFix, a campaign Microsoft Threat Intelligence described on 28 August. In a post on Mastodon the agency said it was closely involved in handling the Berlin incident and pointed readers to that notice.

Microsoft’s write-up explains how one click reached so far. The pasted PowerShell command starts a multistage chain that ends with a Python implant opening a reverse WebSocket tunnel to attacker infrastructure which Microsoft says gives the attacker direct access to the victim’s internal network. Earlier ClickFix variants typically delivered a single infostealer.

Reports received by the BSI show the attackers tried to install ransomware and steal data for double extortion. The agency names the malware as LoremIpsumLoader (also called AxolotLoader) and attributes it to the same financially motivated group behind the Rhysida ransomware and leak site. It rated the threat criticality 2 (yellow).

1.4 Million Records Leaked After the City Refused to Pay

The Berlin ransomware attack lasted several days and came to light on 14 August, according to the city’s own account. The Senate Departments for Transport and the Environment and for Urban Development, Construction and Housing were hit hardest. Rhysida asked for 30 bitcoin which the city put at around two million euros.

The Senate didn’t pay.

Once the ultimatum ran out the group published 1.4 million records including personal and confidential data that the city says other criminals could exploit. The Senate Chancellery says there have been no further attacks on the affected parts of the state network since 13 August and the attacker failed to keep a lasting foothold. Analysis of the leaked data continues alongside IT hardening and the criminal case.

Manuel Atug, an independent German security expert who advised Berlin’s administration in 2023, called the leak a national security crisis. “The damage is extreme. This affects all of Germany and will continue to do so for decades,” he said in an interview published in Sweden. Berlin hasn’t published how the employee reached the fake CAPTCHA page or which leaked documents it rates most sensitive.

Swedish Officers’ Magazine Site Carried Malicious Code

Officerstidningen, the magazine of the Swedish officers’ union Officersförbundet, said on 15 September that intruders exploited a vulnerability in its WordPress platform and planted code designed to trick visitors into installing malware themselves. The code was installed on 21 July, activated on 29 August and removed when the site was patched on 31 August. It targeted Windows computers only. Infection needed an active step from the visitor, for example following an unusual CAPTCHA that asked them to open Run, Terminal or PowerShell and paste a command. The union’s own website was also hit. The magazine gave no figure for how many visitors followed the prompt.

Finland’s National Cyber Security Centre reported several cases of malware spread through hacked websites using ClickFix in its weekly review for week 32. Sweden’s NIS2 law, Cybersäkerhetslagen, requires management in covered organisations to undergo security training.

Dormant Since July and Live a Day After Microsoft’s Warning

The Swedish dates sit uncomfortably close to the Berlin case. The code on Officerstidningen’s site lay dormant from 21 July and went live on 29 August, one day after Microsoft published its TerminalFix analysis and six days before the BSI issued its notice. No source links the Swedish incident to Rhysida or to Berlin. Both attacks still needed the same thing from the victim, a command pasted into Windows by hand. Officerstidningen has told readers who did so to have the computer checked.

References

1. Deutsche Institutionen über TerminalFix-Kampagne kompromittiert
2. BSI post on the Berlin incident
3. TerminalFix campaign deploys a reverse tunnel through multistage intrusion
4. Following a cyberattack: Immediate threat to the administration cleared
5. IT-säkerhetsincident på Officerstidningens webbplats
6. Cybersäkerhetscentrets veckoöversikt 32/2026

This post is also available in: