LeakNet Ransomware - New ClickFix Lures and Deno Loader

What Happened

LeakNet, a ransomware group, is evolving its attack strategies. Previously, they targeted about three victims monthly. Recent findings indicate they are now scaling operations, leveraging new tools that can bypass standard security defenses. Two key innovations are a social engineering tactic called ClickFix and a stealthy loader based on the Deno JavaScript runtime.

The ClickFix method involves planting fake verification pages on compromised legitimate websites. When users encounter these pages, they see a familiar Cloudflare Turnstile check, prompting them to execute a command. This broad approach allows LeakNet to target a wider audience, as there is no specific victim profile. Analysts from ReliaQuest have linked this activity to LeakNet with high confidence, noting consistent tactics and infrastructure.

Who's Being Targeted

The shift to ClickFix puts any web-browsing employee at risk. Since the lures are hosted on legitimate sites, standard network defenses may not detect them, leading to a higher chance of user interaction. Once the malicious command is executed, it can trigger a series of harmful actions. The group also employs Microsoft Teams phishing, creating a consistent post-exploitation chain that makes detection easier for defenders but still poses a significant threat.

Signs of Infection

LeakNet's Deno-based loader is particularly concerning. This loader operates by installing the legitimate Deno executable on the victim's machine, running harmful code without leaving traditional file traces. The loader is activated through scripts named Romeo*.ps1 and Juliet*.vbs. By using a bring-your-own-runtime approach, LeakNet minimizes detection risks associated with deploying custom binaries.

Once activated, the loader collects system information and connects to attacker-controlled servers to fetch the next stage of the attack. This process remains largely invisible to signature-based security tools, making it a formidable threat.

How to Protect Yourself

Organizations should take immediate action to mitigate risks from LeakNet's tactics. Blocking newly registered domains can help, as their command-and-control servers are often short-lived. Additionally, restricting users from executing Win-R commands and limiting PsExec access to authorized administrators can reduce exposure. Security teams should monitor for unusual activities, such as jli.dll sideloading and unexpected outbound connections. Rapid isolation of compromised hosts is crucial to prevent ransomware deployment and protect sensitive data.