LeakNet Ransomware - New ClickFix Tactics Uncovered

What Happened

The LeakNet ransomware operation has recently evolved its tactics by incorporating a method known as ClickFix. This technique is delivered through compromised websites, marking a significant shift from traditional initial access methods like stolen credentials. Instead of relying on third-party suppliers or initial access brokers, LeakNet now uses compromised sites to trick users into executing harmful commands to fix fake errors.

In these attacks, victims are presented with legitimate-looking CAPTCHA verification checks that prompt them to copy and paste a command into their Windows Run dialog. This approach reduces the operational bottleneck and allows for a broader reach, as it does not depend on specific industry targets. The cybersecurity firm ReliaQuest highlighted that this change in strategy allows for a more streamlined attack process, enabling attackers to execute their plans more efficiently.

Who's Being Targeted

LeakNet's new tactics are not limited to any specific industry. By casting a wide net, the group aims to infect as many victims as possible. The use of compromised websites to deliver these attacks means that unsuspecting users from various sectors are at risk. This broad targeting strategy is designed to maximize the potential for infection and subsequent ransom demands.

The adoption of ClickFix also signals a strategic shift for LeakNet, moving away from dependency on initial access brokers. This change allows them to operate more quickly and broadly, increasing their chances of success in ransomware attacks.

Signs of Infection

Victims may notice unusual behavior on their systems, particularly after interacting with compromised websites. If users have executed commands prompted by fake error messages, they may be infected with the LeakNet ransomware. The ransomware employs a Deno-based loader to execute malicious payloads directly in memory, minimizing on-disk evidence that could alert security measures.

As the attack unfolds, LeakNet's methodology includes using DLL side-loading to launch malicious code, lateral movement within the network, data exfiltration, and ultimately, encryption of files. Users should remain vigilant for signs of unauthorized access or unusual system performance.

How to Protect Yourself

To safeguard against LeakNet and similar ransomware attacks, users should adopt several best practices. First, ensure that all software is up-to-date, as vulnerabilities can be exploited by these types of malware. Additionally, be cautious when interacting with unfamiliar websites or executing commands prompted by pop-ups or error messages.

Implementing robust endpoint protection solutions can help detect and block malicious activities. Regularly back up important data to secure locations, ensuring that files can be restored in the event of a ransomware attack. Lastly, educating users about social engineering tactics, such as ClickFix, can significantly reduce the risk of falling victim to these schemes.