Germany's federal cyber agency has confirmed how one of the most damaging attacks on German public administration in years got in: a fake CAPTCHA, a copied terminal command and one distracted employee.
In a security advisory and a follow-up post on Mastodon, the BSI (Federal Office for Information Security) identified a campaign it calls 'TerminalFix' as the initial access vector in the August attack on two Berlin Senate departments — the breach in which the Rhysida ransomware gang stole and later published around 1.44 million files, including personnel records, disciplinary files and details on critical infrastructure. The analysis builds on research by Microsoft, which had already warned about the related 'ClickFix' family in February.
TerminalFix is a social-engineering chain that abuses Windows' own tools. A victim is lured to a manipulated or malicious website — via phishing mail or 'water-holing', the planting of traps on sites the target regularly visits. The page displays a fake Cloudflare CAPTCHA, while JavaScript silently copies a PowerShell command to the clipboard. On-screen instructions ask the victim to press Windows+X and then 'I' to open the Windows Terminal, and to paste the command.
The command downloads the first stage of the malware in the background while the victim keeps 'proving they are human' in the foreground. The malware sideloads a signed, benign Windows binary — LockScreenContentServer.exe — to run a malicious DLL named dui70.dll, whose code pulls PNG images from attacker servers in which further programs are hidden using steganography. The final payload installs itself persistently via registry keys, checks every 60 minutes whether it is still running, and sets up a SOCKS proxy: a tunnel that gives the attackers a foothold inside the victim's network, where they can observe traffic and move laterally.
The follow-on was devastating in Berlin partly because the environment made it easy: password lists stored in plain text gave Rhysida a fast path through the Senate departments for building and for mobility and transport. The state refused the roughly two-million-euro ransom demand, and on 4 September the gang published the stolen data on the dark web.
The BSI now warns of an 'elevated threat level for society'. It notes that in 92 percent of cases in which criminals threaten to publish data, they follow through — and that Rhysida concentrates on health care and education, with public administration among its five most common target types.
The agency's underlying message to every organization is that the entry vector is mundane. The campaign needs only one employee who visits the wrong page and follows three on-screen steps — which is why security experts are telling staff to treat unexpected CAPTCHAs, especially ones that ask for keyboard shortcuts, with deep suspicion.
