Executive Summary
In March 2026, the LeakNet ransomware group initiated a sophisticated attack campaign leveraging the ClickFix social engineering technique and the Deno JavaScript runtime. By presenting fake prompts, they tricked users into executing malicious commands, leading to the deployment of a Deno-based loader that executed JavaScript payloads directly in system memory. This method minimized forensic evidence and enhanced evasion of traditional security measures.
The adoption of legitimate tools like Deno for malicious purposes underscores a growing trend among threat actors to evade detection. Organizations must remain vigilant against such evolving tactics, emphasizing the need for comprehensive security awareness training and advanced threat detection mechanisms.
Why This Matters Now
The LeakNet ransomware group's use of legitimate tools like Deno for malicious purposes highlights a growing trend among threat actors to evade detection. Organizations must remain vigilant against such evolving tactics, emphasizing the need for comprehensive security awareness training and advanced threat detection mechanisms.
Attack Path Analysis
The LeakNet ransomware group initiated their attack by employing the ClickFix social engineering technique to trick users into executing malicious scripts, leading to the installation of the legitimate Deno runtime. Utilizing Deno, they executed JavaScript payloads in-memory, minimizing forensic artifacts and evading detection. The attackers then escalated privileges by sideloading malicious DLLs via Java, enabling them to gain higher-level access within the system. They moved laterally across the network using tools like PsExec, facilitating the spread of their ransomware. Command and control were maintained through persistent polling loops, allowing the attackers to receive new commands and deploy additional payloads. Data exfiltration was conducted by abusing Amazon S3 buckets, transferring sensitive information to external locations. Finally, the attackers deployed ransomware to encrypt critical data, disrupting business operations and demanding ransom payments.
Kill Chain Progression
Initial Compromise
Description
The attackers used the ClickFix social engineering technique to deceive users into executing malicious scripts, leading to the installation of the legitimate Deno runtime.
MITRE ATT&CK® Techniques
User Execution: Malicious Copy and Paste
Command and Scripting Interpreter: PowerShell
System Binary Proxy Execution: Mshta
Obfuscated Files or Information
Application Layer Protocol: DNS
Valid Accounts
Application Layer Protocol: Web Protocols
Archive Collected Data: Archive via Utility
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Applications and Workloads
Control ID: Pillar 3
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
ClickFix social engineering and Deno-based memory execution bypass traditional security controls, threatening financial data integrity and regulatory compliance requirements.
Health Care / Life Sciences
LeakNet's stealthy runtime attacks and S3 data exfiltration pose severe HIPAA compliance risks for healthcare organizations storing sensitive patient information.
Computer Software/Engineering
Deno runtime abuse exploits developer environments and legitimate tools, making software companies vulnerable to bring-your-own-runtime attack techniques.
Government Administration
Advanced evasion techniques using legitimate Deno runtime threaten government systems requiring zero trust segmentation and enhanced lateral movement protection.
Sources
- LeakNet ransomware uses ClickFix, Deno runtime in stealthy attackshttps://www.bleepingcomputer.com/news/security/leaknet-ransomware-uses-clickfix-and-deno-runtime-for-stealthy-attacks/Verified
- CastleRAT attack first to abuse Deno JavaScript runtime to evade enterprise securityhttps://www.threatdown.com/blog/castlerat-cyber-attack-is-the-first-to-abuse-deno-javascript-runtime-to-evade-enterprise-security/Verified
- Velvet Tempest Uses ClickFix to Deploy CastleRAT for Termitehttps://anonhaven.com/en/news/velvet-tempest-clickfix-castlerat-termite-ransomware/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF may have limited the attacker's ability to exploit the Deno runtime by enforcing strict execution policies and monitoring for unauthorized script executions.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely have constrained the attacker's ability to escalate privileges by limiting access to critical system components.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely have limited the attacker's ability to move laterally by enforcing strict access controls between workloads.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely have constrained the attacker's command and control capabilities by monitoring and controlling outbound communications.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely have limited the attacker's ability to exfiltrate data by enforcing strict outbound data transfer policies.
While earlier controls may have limited the attacker's progression, the deployment of ransomware could still impact accessible systems, potentially disrupting operations.
Impact at a Glance
Affected Business Functions
- IT Operations
- Data Management
- Customer Service
Estimated downtime: 14 days
Estimated loss: $500,000
Potential exposure of sensitive corporate data, including customer information and internal communications.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and limit lateral movement within the network.
- • Deploy East-West Traffic Security controls to monitor and restrict internal traffic, detecting unauthorized lateral movement attempts.
- • Utilize Egress Security & Policy Enforcement to control outbound traffic, preventing unauthorized data exfiltration to external destinations.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to unusual activities, such as the execution of legitimate tools like Deno in unexpected contexts.
- • Establish Multicloud Visibility & Control to monitor and manage activities across cloud environments, ensuring comprehensive oversight and rapid response to potential threats.
