LeakNet boosts ransomware with ClickFix lures, stealthy Deno loader

Cybersecurity: LeakNet's Ransomware Operations

LeakNet has enhanced its ransomware operations by integrating mass-market ClickFix lures with a Deno-based loader that operates primarily in memory, reducing the time available for defensive actions.

LeakNet is currently averaging three victims per month. The group has expanded its delivery and execution infrastructure to increase this number. Rather than depending on initial access brokers, LeakNet now utilizes ClickFix lures hosted on compromised legitimate websites. These are followed by a Deno-based loader that acts like a legitimate developer tool while executing malicious code in memory.

Recent investigations have identified two key innovations: ClickFix prompts tricking users into executing msiexec commands, and a bring-your-own-runtime (BYOR) approach using a legitimate Deno binary to decode and run a base64-encoded payload without leaving a traditional malware file on disk. This provides a predictable sequence of behaviors for defenders to target.

ClickFix employs social engineering to deceive users into executing attacker-supplied commands, often through Windows Run or similar entry points. LeakNet distributes these lures via compromised legitimate websites. An example is a fake Cloudflare Turnstile verification page that instructs users to execute an msiexec command linked to attacker-controlled infrastructure.

This method reduces LeakNet’s acquisition cost per victim and broadens the potential victim pool. Upon execution of the initial command, LeakNet often transitions to a Deno-based loader that executes JavaScript or TypeScript directly in memory, leaving minimal artifacts on disk.

LeakNet maintains consistent post-compromise behavior across incidents. The group uses DLL sideloading, placing a trojanized jli.dll alongside a legitimate Java binary, to make malicious activity appear as normal Java and Windows Update-related processes.

Subsequent actions include command-and-control using a repeatable URL pattern, lateral movement with PsExec, and staging/exfiltration through S3 bucket infrastructure. LeakNet relies on trusted binaries, cloud services, and compromised websites, necessitating a focus on behavioral detection over signature-only methods.

Artifact Details Artifact Details

tools.usersway[.]net Clickfix Domain on Compromised Websites okobojirent[.]com Deno C2 Domain

apiclofront[.]com Clickfix Domain mshealthmetrics[.]com Deno C2 Domain

sendtokenscf[.]com Clickfix Domain verify-safeguard[.]top Deno C2 Domain

binclloudapp[.]com Clickfix Domain 194.31.223[.]42 Deno C2 IP Address

neremedysoft[.]com Sideloaded jli.dll C2 Domain 144.31.2[.]161 Deno C2 IP Address

ndibstersoft[.]com Sideloaded jli.dll C2 Domain 87.121.79[.]6 Deno C2 IP Address

windowallclean[.]com Sideloaded jli.dll C2 Domain 87.121.79[.]25 Deno C2 IP Address

cnoocim[.]com Deno C2 Domain 144.31.54[.]243 Deno C2 IP Address

delhedghogeggs[.]com Deno C2 Domain 144.31.224[.]98 Deno C2 IP Address

serialmenot[.]com Deno C2 Domain fastdlvrss.s3.us-east-1.amazonaws[.]com Malicious S3 Bucket

crahdhduf[.]com Deno C2 Domain backupdailyawss.s3.us-east-1.amazonaws[.]com Malicious S3 Bucket

Based on reporting by GBHackers.