LeakNet Uses ClickFix and Deno Loader in Ransomware Attacks
Summary
ReliaQuest reports LeakNet uses ClickFix on compromised websites to deliver commands, followed by a Deno-based in-memory loader and a repeatable chain involving DLL side-loading, PsExec, S3 exfiltration, and encryption.
Key points
- ReliaQuest reports LeakNet has shifted from relying on initial access brokers to ClickFix delivered through compromised legitimate websites.
- Fake CAPTCHA pages instruct users to run an msiexec.exe command through Windows Run.
- LeakNet is assessed to use Deno to execute Base64-encoded JavaScript in memory, fetch additional payloads, and repeatedly retrieve and execute code.
- The reported post-compromise sequence includes DLL side-loading, PsExec lateral movement, data exfiltration to S3 buckets, and encryption.
- ReliaQuest says LeakNet uses klist to identify active authentication credentials and assess reachable accounts and services.
- A separate Microsoft Teams phishing intrusion attempt used a similar Deno-based loader, but ReliaQuest did not attribute it.
Article Details
- Attack Vectors
- LeakNet uses ClickFix on compromised legitimate websites, where fake CAPTCHA checks trick users into copying and running an msiexec.exe command in the Windows Run dialog.
- A Deno-based loader executes Base64-encoded JavaScript in memory, fingerprints the system, contacts an external server for next-stage malware, and polls for additional code.
- LeakNet’s reported post-compromise sequence includes DLL side-loading, lateral movement with PsExec, exfiltration to S3 buckets, and encryption.
- A separate, unattributed intrusion attempt used Microsoft Teams-based phishing to deliver a payload chain ending in a similar Deno-based loader.
- Defensive Notes
- Monitor for fake CAPTCHA-driven instructions that prompt users to copy and run commands, including msiexec.exe, in the Windows Run dialog.
- Detect Deno execution of Base64-encoded JavaScript, system fingerprinting, outbound requests to retrieve payloads, and repeated polling for additional code.
- Look for DLL side-loading followed by PsExec use, cmd.exe /c klist execution, and suspicious data transfers to S3 buckets.
- The article reports that the post-compromise sequence is consistent across the described LeakNet entry paths, offering behaviors defenders can monitor before ransomware deployment.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader uses Base64-encoded JavaScript payloads.T1059.003 · Windows Command ShellLeakNet runs cmd.exe /c klist on compromised systems.T1059.007 · JavaScriptThe Deno-based loader executes Base64-encoded JavaScript in memory and executes additional fetched code.T1082 · System Information DiscoveryThe Deno-based payload fingerprints the compromised system.T1105 · Ingress Tool TransferThe loader contacts an external server to fetch next-stage malware and polls for additional code.T1204.004 · Malicious Copy and PasteLeakNet’s fake CAPTCHA prompts users to copy and paste a command into the Windows Run dialog.T1218.007 · MsiexecThe ClickFix instructions trick users into running an msiexec.exe command.T1486 · Data Encrypted for ImpactEncryption is the final stage of LeakNet’s described post-compromise sequence.T1567.002 · Exfiltration to Cloud StorageThe article reports that LeakNet stages and exfiltrates data using S3 buckets.T1569.002 · Service ExecutionLeakNet uses PsExec during its post-compromise activity.T1574.002 · DLL Side-LoadingLeakNet’s post-compromise sequence uses DLL side-loading to launch a malicious DLL delivered via the loader.
Threat Actors
Products
DenoThe operation also uses a Deno-based in-memory loader and a consistent post-exploitation chain—DLL side-loading, PsExec lateral movement, S3 exfiltration, and encryption—providing detectable behaviors defenders canMicrosoft TeamsSimilar Deno-based loaders delivered via Microsoft Teams phishing suggest the BYOR approach is spreading or being adopted by other threat actors.Microsoft WindowsIn these attacks, the legitimate-but-compromised sites are used to serve fake CAPTCHA verification checks that instruct users to copy and paste a “msiexec.exe” command to the Windows Run dialog.