[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4kHJf0fTCauL4k6-a4aHaRZNRj1lox267AA7DwTYrJY":3},{"article":4,"iocs":32,"watch_terms":49,"solutions":50,"lesson":10},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"a1bc7853-e78e-43fb-a0d8-e2d0de63d9f4","LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader","leaknet-ransomware-uses-clickfix-via-hacked-sites-deploys-deno-in-memory-loader","The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials","LeakNet ransomware has adopted the ClickFix social engineering tactic delivered through compromised websites as its primary initial access method, moving away from reliance on stolen credentials from initial access brokers. The group deploys a Deno-based in-memory loader to execute malicious payloads while minimizing on-disk forensic evidence, followed by a consistent post-compromise methodology involving DLL side-loading, lateral movement via PsExec, and data exfiltration to S3 buckets before encryption.",null,"https:\u002F\u002Fthehackernews.com\u002F2026\u002F03\u002Fleaknet-ransomware-uses-clickfix-via.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjNHJfW8wlD2yQtP3pzAZhSRXNrzlhxXWqqG6GiAH3nbBo44Bz5mQxZ1LtsokhDYs-FC2t8hyphenhyphenY-TlNvck_Rtou9A_AA9lRnKNDRbMxZTpHfAe-6WETM-yJoWzxTANKVWrcZFdu7sax22JeTcWAVwuLKMibTNkLwSRyC0_HfBgCFM6EWqPl5-HbGtJEiSCTC\u002Fs1600\u002Fleaknet-ransomware.jpg","2026-03-17T14:34:00+00:00","2026-03-17T17:00:11.965935+00:00",9,[],"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":17,"icon":10,"name":19,"slug":20},"Ransomware","ransomware",[22,27],{"category":23},{"id":24,"icon":10,"name":25,"slug":26},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":28},{"id":29,"icon":10,"name":30,"slug":31},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[33,36,39,43,46],{"type":26,"value":34,"context":35},"LeakNet","Ransomware operation using ClickFix and Deno-based loaders for initial access and payload execution",{"type":26,"value":37,"context":38},"Deno-based loader","In-memory JavaScript execution tool used by LeakNet to evade detection and execute Base64-encoded payloads",{"type":40,"value":41,"context":42},"mitre_attack","T1218.009","DLL side-loading technique used in LeakNet's post-compromise activity",{"type":40,"value":44,"context":45},"T1021.002","PsExec lateral movement used by LeakNet during intrusion",{"type":40,"value":47,"context":48},"T1566.002","Phishing via Microsoft Teams observed as alternative initial access vector",[],{"controls":51,"vendors":133},[52,81,108],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":82,"name":83,"problem":84,"products":85},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":103,"product_name":104,"url":106,"description":107},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"slug":109,"name":110,"problem":111,"products":112},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[113,120,127],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":109,"product_name":117,"url":118,"description":119},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":124,"url":125,"description":126},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[134,140],{"slug":135,"name":136,"logo_path":137,"roles":138},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png",[139],"reported_by",{"slug":141,"name":142,"logo_path":143,"roles":144},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png",[139]]