Threat Actor
LeakNet
- First Reported
- Mar 17, 2026
- Latest Reported
- Mar 17, 2026
Reported Context (3)
- The article attributes ClickFix-based initial access, a Deno-based loader, and a post-compromise sequence involving DLL side-loading, PsExec, S3 exfiltration, and encryption to the LeakNet ransomware operation. LeakNet Uses ClickFix and Deno Loader in Ransomware Attacks
- The article identifies LeakNet as a ransomware gang and attributes the reported ClickFix, Deno-loader, lateral-movement, and exfiltration activity to its operators. ReliaQuest Reports LeakNet Uses ClickFix and Deno to Deploy In-Memory Payloads
- ReliaQuest attributed ClickFix and Deno-loader activity to LeakNet with high confidence based on overlapping infrastructure and TTPs consistent with previously confirmed activity. The article also describes its recurring DLL sideloading, PsExec lateral movement, and S3 staging. ReliaQuest Details LeakNet’s ClickFix Lures and Deno-Based In-Memory Loader
MITRE ATT&CK (20)
Products (3)
Tools (1)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.