What happened?
The Federal Office for Information Security (BSI) has confirmed via Mastodon that the "TerminalFix" attack campaign was the entry point for the cyberattack on Berlin Senate departments. Affected were the Senate Department for Urban Development, Building and Housing, as well as the Senate Department for Mobility, Transport, Environment and Climate Protection. The attack became known in mid-August 2026 and led to a massive data breach involving some critical information. According to reports by Spiegel, the well-known ransomware gang Rhysida is behind the attack.
The Details
The timeline of the incident reveals the scale of the crisis: data was already being exfiltrated by the attackers from August 7 to 12, 2026, though the actual attack began significantly earlier. On August 14, the affected Senate departments were isolated from the state network, and three days later the Senate Chancellery publicly reported on an "ICT incident in the Berlin state network" and set up an emergency crisis team. The Federal Criminal Police Office (BKA) and the State Criminal Police Office (LKA) launched investigations.
The consequences were also felt by citizens: on August 21, problems arose with transfer payments, including the inability to pay housing benefits to 50,000 eligible households in Berlin. It wasn't until August 24 that all parts of the Senate administration were back online. On August 28, it was confirmed that the attackers had stolen data and were demanding a ransom—Governing Mayor Kai Wegner declared that the state of Berlin would not give in to extortion. A demand for 30 Bitcoin, equivalent to around 2 million euros, appeared on Rhysida's darknet site, accompanied by alleged data excerpts including plaintext password lists, judicial documents, and more than 46,500 contracts belonging to the state.
On September 4, the criminals finally published around 1.44 million files on the darknet, including personnel records, information on disciplinary proceedings, financial records, and details on Berlin's critical infrastructure. The BSI subsequently warned on September 5 of an "elevated threat level" for society.
Technical Process of TerminalFix
According to Microsoft, TerminalFix is a variant of the "ClickFix" malware campaign already known since February 2026. Users are tricked into opening the Windows Terminal—but unlike ClickFix, which uses the [Windows]+[R] key combination, TerminalFix uses the [Windows]+[X] shortcut followed by [I] for direct access to PowerShell.
A malicious command is then executed via PowerShell, which the user must paste from the clipboard themselves. The command ends up there because a manipulated website automatically copied it via JavaScript. These sites simulate a fake Cloudflare captcha—a piece of social engineering that exploits the fact that genuine Cloudflare captchas already require varying user actions, meaning unusual keyboard input doesn't immediately raise suspicion.
The executed command downloads the initial malware in the background via script, while the manipulated website distracts the user with the fake captcha. Among other things, the signed, otherwise benign Windows file "LockScreenContentServer.exe" is abused to sideload the file "dui70.dll". This in turn downloads PNG image files in which further malware is hidden using steganography.
The malware then establishes persistence via registry keys, checks its own status hourly, and waits for new commands from the attackers. Additionally, a SOCKS proxy is set up, giving the attackers a tunnel into the affected organization's network. Files and directories are hidden in Windows Explorer to make detection more difficult.
Assessment
Particularly alarming: passwords at the Berlin agencies were apparently stored in plaintext, which, according to the report, gave Rhysida a relatively easy path in. How exactly the attackers ultimately gained access to nearly all the data of both Senate departments remains unclear.
Public administrations are considered particularly vulnerable targets, as names, email addresses, and staff structures are often partially publicly accessible—an ideal breeding ground for social engineering. Such attacks are also called "watering hole" attacks, since the manipulated websites are placed where victims regularly visit, for example via phishing emails, social media links, or forum posts. Even if an attempt only succeeds after many tries, the effort pays off given the ransom demand of around 2 million euros.
The BSI also refers to an unnamed external service provider, according to which Rhysida actually follows through on its publication threats in 92 percent of cases where it threatens to do so. The group focuses primarily on the healthcare and education sectors, but public administrations are also among the five most frequently targeted sectors.
Warning of Secondary Damage
CCC spokesperson Joachim Selzer already warned on August 30 of possible identity theft and further fraud attempts. Citizens whose personal data might be included in the published dataset could also easily fall victim to extortion attempts.
Practical Tips
- Employees should be trained to critically question suspicious requests to use the terminal, PowerShell, or the Run dialog—especially when these appear in the context of a captcha or verification process.
- Passwords must never be stored in plaintext; the use of password managers with encryption is mandatory.
- Regular checks of registry entries and unusual network traffic (such as SOCKS proxy connections) can help detect persistent malware early.
- Since signed, legitimate Windows files can be abused for sideloading, endpoint detection solutions that also monitor the behavior of signed software are advisable.
- Agencies and organizations should, as was done in Berlin, consistently isolate their systems in an emergency and communicate transparently both externally and internally.
Outlook
The state of Berlin has since established a "control unit" through which those affected by the leak are to be contacted by email and letter. At the same time, according to the Senate department, a review of all approximately 12,000 of the state's systems is underway "around the clock." Exactly how the attackers managed to access practically all the data of the two administrations remains the subject of ongoing investigations by the BKA and LKA. Clarifying this point will likely be crucial in determining how similar attacks on other agencies can be prevented in the future. Given the "elevated threat level" declared by the BSI, further details about the incident and Rhysida's activities are expected to follow.
