News

Security researchers have observed the LeakNet ransomware group embracing the ClickFix social-engineering method, using hijacked legitimate websites to trick victims into executing malicious commands. In a recent technical analysis, ReliaQuest noted this user-targeted trick-where people are persuaded to paste and run commands to “fix” fabricated errors-represents a departure from the group’s prior reliance on stolen credentials sourced from initial access brokers (IABs).

Alongside the ClickFix tactic, ReliaQuest highlighted a second major innovation: a staged command-and-control loader built on the Deno JavaScript runtime that runs payloads directly in memory. The combination yields a repeatable post-exploitation pattern, something defenders can detect and interrupt before encryption occurs, the firm said.

LeakNet first surfaced in November 2024 and has characterized itself as a “digital watchdog” focused on internet freedom and transparency. Dragos data also indicate the group has targeted industrial organizations, expanding its reach beyond consumer-facing victims.

The switch to ClickFix brings several operational benefits for the attackers. By engineering access through compromised but otherwise legitimate sites, LeakNet reduces dependence on third parties, cuts acquisition costs per victim, and avoids the delays involved in waiting for valuable credentials to be sold on the market. In practice, attackers use these compromised pages to display bogus CAPTCHA checks that instruct users to copy a line invoking “msiexec.exe” into the Windows Run box-an action that appears routine but instantiates the malicious chain.

This technique is broadly applied rather than focused on a single sector, allowing the operators to cast a wide net. ReliaQuest warned that ClickFix abuses trusted, everyday workflows to persuade users to execute commands via standard Windows tooling, making the ruse feel normal and lowering suspicion.

ReliaQuest describes LeakNet’s adoption of ClickFix as the first documented expansion of the group’s initial-access toolkit and a meaningful shift in strategy. By reducing reliance on IABs, LeakNet eliminates a natural bottleneck that limited the speed and scale of its operations. Furthermore, because the initial lure is served through legitimate-but-compromised websites, the activity does not produce the same obvious network-layer indicators that would be associated with attacker-owned infrastructure.

On the payload side, LeakNet is using a Deno-based loader that decodes Base64-encoded JavaScript and executes it in memory to limit on-disk artifacts and evade detection. The in-memory code fingerprints the infected host, reaches out to a remote server to retrieve follow-on components, and then enters a polling loop that repeatedly fetches and runs additional code via the Deno runtime.

ReliaQuest also reported a separate intrusion where social engineering conducted over Microsoft Teams convinced a user to launch a chain that culminated in the same type of Deno-based loader. That incident is unattributed; however, the “bring your own runtime” (BYOR) approach either indicates LeakNet is broadening its initial-access methods or that other threat actors have begun to copy the technique.

After gaining a foothold, LeakNet follows a consistent post-compromise workflow: the attackers use DLL side-loading to execute a malicious DLL delivered by the loader, perform lateral movement with PsExec, steal data, and finally encrypt systems. As part of reconnaissance, the operators run “cmd.exe /c klist” to enumerate active authentication tickets on the host, which reveals accounts and services that can be reached without requesting additional credentials and speeds lateral activity.

For staging and exfiltration, the group leverages S3 buckets, blending malicious uploads with routine cloud traffic to reduce the likelihood of detection.

These developments arrive as Google published its list of the top ransomware families by victims claimed on data-leak sites: Qilin (aka Agenda), Akira (aka RedBike), Cl0p, Play, SafePay, INC Ransom, Lynx, RansomHub, DragonForce (aka FireFlame and FuryStorm), and Sinobi. The Google Threat Intelligence Group (GTIG) also reported that roughly one-third of incidents involved confirmed or suspected vulnerability exploitation-most commonly in widely used VPNs and firewalls-and that 77% of analyzed ransomware cases included suspected data theft, up from 57% in 2024.

GTIG added that, despite disruptions among threat actor groups and law-enforcement actions, the extortion ecosystem remains resilient and attackers stay motivated. At the same time, there are signs overall profitability is waning, prompting some actors to shift from targeting a few large enterprises to pursuing a higher volume of smaller victims.