ReliaQuest Reports LeakNet Uses ClickFix and Deno to Deploy In-Memory Payloads
Summary
ReliaQuest reports that LeakNet uses ClickFix to gain access, then runs malicious code through the legitimate Deno runtime. The reported attack chain includes DLL sideloading, PsExec, C2 beaconing and data exfiltration via Amazon S3.
Key points
- ReliaQuest says ClickFix lures lead victims to execute malicious commands and deploy a Deno-based loader.
- VBS and PowerShell stagers reportedly run the legitimate, signed Deno runtime to execute JavaScript payloads in memory.
- The reported stagers use names matching Romeo*.ps1 and Juliet*.vbs.
- After execution, the code fingerprints the host, generates a victim ID and contacts C2 to retrieve a second-stage payload and receive commands.
- Reported post-exploitation activity includes DLL sideloading, credential discovery with klist, and lateral movement using PsExec.
- ReliaQuest identifies potential detection opportunities including Deno outside development environments, unusual PsExec use, unexpected S3 traffic and DLL sideloading in uncommon directories.
Article Details
- Event Type
- LeakNet ransomware operations are using ClickFix social engineering and a Deno-based loader in attacks.
- Impact
- The reported attack chain can execute JavaScript/TypeScript payloads in memory, retrieve a second-stage payload, use DLL sideloading and PsExec for lateral movement, and exfiltrate data through Amazon S3. The article reports minimal disk artifacts but does not quantify impact on specific victims.
MITRE ATT&CK
T1059.001 · PowerShellPowerShell scripts are used to initiate the observed activity.T1059.005 · Visual BasicVBS scripts are used to initiate the observed activity.T1059.007 · JavaScriptA Deno-based loader executes JavaScript payloads in memory.T1105 · Ingress Tool TransferThe malware connects to command-and-control infrastructure to retrieve a second-stage payload.T1204 · User ExecutionClickFix lures trick users into running malicious commands.T1567.002 · Exfiltration to Cloud StorageThe reported activity involves data exfiltration using Amazon S3.T1569.002 · Service ExecutionPsExec is used for lateral movement.T1574.002 · DLL Side-LoadingThe reported post-exploitation activity includes DLL sideloading.