LeakNet
A ransomware operator active since late 2024. It used to buy access but, by March 2026, ReliaQuest saw it running its own ClickFix lures on compromised legitimate websites and using a legitimate runtime to load malware in memory.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
LeakNet matters less for its size, which ReliaQuest put at about three victims a month, than for what its change of method shows.3 By running ClickFix itself, it no longer relies only on access bought from brokers. ReliaQuest describes delivery through compromised legitimate websites as opportunistic, so a target does not need to be chosen in advance.3
The loader runs on Deno, a legitimate and signed JavaScript runtime. ReliaQuest calls this bring your own runtime, and says it can get past filters for unknown executables because most of the activity stays in memory.3,2
The sources reviewed do not establish a UK link or a sector focus. No confirmed link to other ransomware groups has been established, according to a Fortra article, which also says LeakNet does not appear to run a traditional affiliate programme.1
This chain starts with a user pasting a command, so a patched estate does not stop it. We would look at who can run command prompts and installers, and whether developer runtimes are expected on a given machine.
How It Attacks
Based on ReliaQuest's March 2026 analysis.3
- 1
Lure the User
A compromised legitimate website shows a ClickFix prompt that persuades the user to run a command.
- 2
Load in Memory
The command fetches a Deno-based loader, which runs encoded JavaScript mostly in memory and fingerprints the host.
- 3
Establish Control
A legitimate Java process sideloads a malicious DLL, and the host checks in regularly with attacker infrastructure.
- 4
Check Sessions
Looks at active authentication sessions so it can move without requesting new credentials.
- 5
Move Laterally
Uses PsExec to reach other systems.
- 6
Stage and Steal
Stages and exfiltrates data through Amazon S3 buckets, blending with normal cloud traffic.
Key Techniques
ATT&CK v20 has no group entry for LeakNet. This mapping is ours, based on ReliaQuest.3
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1189 | Drive-by Compromise | Initial Access | Delivers lures through compromised legitimate websites. |
| T1204.004 | Malicious Copy and Paste | Execution | Persuades users to run a command. |
| T1059.007 | JavaScript | Execution | Runs encoded JavaScript through Deno. |
| T1574.001 | DLL | Stealth | A Java process sideloads a malicious DLL. |
| T1033 | System Owner/User Discovery | Discovery | Checks active authentication sessions. |
| T1569.002 | Service Execution | Execution | Uses PsExec. |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | PsExec relies on admin shares. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends data to Amazon S3 buckets. |
Tools Observed
Living Off the Land
Data Theft
From ReliaQuest.3 These are legitimate tools or services, so context matters.
Vulnerabilities
The sources reviewed tie no specific CVE to LeakNet, although ReliaQuest says it has used compromised edge devices.3
Warning Signs
From ReliaQuest's guidance as reported by BleepingComputer.2 None of these proves an attack alone.
- Deno running outside development environments
- Abnormal PsExec use
- Unexpected traffic to Amazon S3 buckets
- A user running an installer or script after visiting a website
Defences That Matter
Prepare Users for ClickFix
- Teach staff that no website needs them to paste a command to prove anything.
- Run simulations using this kind of prompt.
Control What Runs
- Watch for runtimes such as Deno outside development environments,2 and block them where they have no business use.
- Limit who can run PsExec, and alert on abnormal use.2
Would Your Users Paste That Command?
We can test how your people and endpoint controls respond to the methods in this profile.
Sources
- Fortra: What Is LeakNet?, undated, 2026
- BleepingComputer: LeakNet ransomware uses ClickFix, Deno runtime in stealthy attacks, 17 March 2026
- ReliaQuest: Casting a Wider Net: ClickFix, Deno, and LeakNet's Scaling Threat, 17 March 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.