LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader
LeakNet ransomware has adopted the ClickFix social engineering tactic delivered through compromised websites as its primary initial access method, moving away from reliance on stolen credentials from initial access brokers. The group deploys a Deno-based in-memory loader to execute malicious payloads while minimizing on-disk forensic evidence, followed by a consistent post-compromise methodology involving DLL side-loading, lateral movement via PsExec, and data exfiltration to S3 buckets before encryption.
AI summary of the linked source. Not reviewed by an editor. How this works
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — LeakNet
- malware — Deno-based loader
- mitre_attack — T1218.009
- mitre_attack — T1021.002
- mitre_attack — T1566.002