CL-CRI-1171 Pay-Per-Install Network Analysis

Executive Summary

A recent investigation by Palo Alto Networks' Unit 42 has exposed a long-running and extensive cybercrime operation tracked as CL-CRI-1171. This threat cluster operates a sophisticated pay-per-install (PPI) service, leveraging popular platforms like YouTube and search engine optimization (SEO) poisoning to achieve widespread infections. The campaign has been active for at least two years, successfully compromising both individual gamers and high-value targets within corporate, government, and critical infrastructure sectors.

The operation's effectiveness stems from its use of a generic, custom-built loader that appears as unremarkable commodity malware, thus avoiding deeper security analysis. This loader serves as a delivery mechanism for a rotating bundle of payloads from various cybercriminal clients. Analysis revealed the distribution of several malware families, including the newly identified Insomnia RAT and the previously undocumented ARKTunnel and Docro Hijacker malware. The infrastructure supporting this campaign is vast, involving over 10,000 loader samples and more than 200 rotational command-and-control (C2) domains, highlighting the scale and persistence of this threat.

Threat Overview

The CL-CRI-1171 operation functions as a Malware-as-a-Service (MaaS) platform, specifically a PPI network. The operators provide an infection service to other threat actors, who pay to have their own malicious payloads distributed to a wide audience. The investigation was triggered by two seemingly routine infections at separate organizations that shared an identical, untracked loader, which led to the discovery of the broader campaign.

Key components of the threat include:

• Infection Vectors: The group employs a two-pronged approach to lure victims:

  1. YouTube Gaming Lures: The threat actors managed at least eleven popular YouTube channels with hundreds of thousands of followers. These channels offered legitimate-seeming gaming content, such as tutorials on improving game performance, while tricking viewers into downloading malicious tools from linked sites.
  2. SEO Poisoning: This funnel targeted a more professional audience by promoting trojanized versions of legitimate software, such as a Bluetooth driver and the popular utility WinDirStat. Users searching for this software would be directed to malicious sites, leading to malware deployment on corporate endpoints.

• Payload Delivery: A single, custom loader is used across all infection vectors. This loader is designed to be disposable and is capable of fetching and executing multiple, unrelated malware payloads on a compromised system. This means a single infection can result in the deployment of a backdoor, a data hijacker, and other threats simultaneously, each with its own objectives and C2 infrastructure.

Technical Analysis

The core of the CL-CRI-1171 operation is its shared infrastructure, which allows it to scale effectively while remaining difficult to track.

Loader and C2 Infrastructure

The primary common denominator is a custom loader, with over 10,000 unique samples identified. This loader is responsible for the initial compromise and subsequent download of additional payloads. It communicates with a sprawling C2 network characterized by:

• Rotational Domains: Over 200 unique hostnames were observed.
• Naming Pattern: Domains follow a distinctive two-word compound naming pattern (e.g., bubbleslip, churchpail, dinosaursjam).
• TLDs: The domains rotate across .xyz, .cfd, .space, and .info top-level domains.

This rotational infrastructure makes blocklisting based on individual domains ineffective.

Malware Payloads

The PPI model allows for a flexible and rotating set of payloads. While the investigation identified a core bundle in rotation from July 2025 to April 2026, other malware families were also observed. The analyzed payloads include:

• Insomnia RAT: A previously unnamed remote access trojan (RAT) given its name by Unit 42. RATs provide attackers with persistent remote control over a compromised system.
• ARKTunnel: A previously unreported malware family, likely used for creating covert communication channels or tunneling traffic.
• Docro Hijacker: Another previously unreported malware, suggesting it is custom-developed for or by this group. Its function is likely related to browser or data hijacking.
• Other Payloads: In a separate infection in June 2026, the same loader delivered GCleaner and Socks5Systemz, demonstrating the modular nature of the PPI service.

MITRE ATT&CK TTPs

The tactics, techniques, and procedures (TTPs) observed or inferred in this campaign include:

Impact Assessment

The CL-CRI-1171 campaign poses a significant risk due to its broad targeting and deceptive nature. The impact extends beyond the initial infection:

• Enterprise Risk: By successfully penetrating corporate, government, and critical infrastructure networks, the operation provides a foothold for more severe attacks. A seemingly minor adware infection could conceal a RAT, leading to data exfiltration, corporate espionage, or a ransomware deployment.
• Multi-Threat Deployment: The PPI model means a single compromised endpoint can be sold to multiple 'customers'. This results in layered threats, complicating incident response and remediation. An organization might clean one payload while remaining unaware of others operating on the same machine.
• Evasion and Persistence: The use of a generic loader that is dismissed as commodity adware is a key element of the campaign's success. This allows the threats to persist on networks for extended periods, as they are not flagged for priority investigation.
• Supply Chain Risk: The trojanizing of legitimate software tools like WinDirStat represents a form of software supply chain risk, where users' trust in known tools is exploited.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source article. However, the report describes the C2 domain structure.

Cyber Observables — Hunting Hints

Security teams can hunt for potentially related activity using the following patterns:

Detection & Response

Detecting and responding to this threat requires looking beyond surface-level indicators.

Detection

1. Enhanced Scrutiny: Do not dismiss generic or untracked malware alerts as low-priority. Any loader activity should be investigated for subsequent payload downloads.
2. Network Monitoring: Implement rules to detect and alert on connections to the suspicious TLDs (.xyz, .cfd, .space, .info), especially when combined with unusual domain name patterns. Use Network Traffic Analysis to baseline normal activity and spot anomalies.
3. EDR Queries: Use Endpoint Detection and Response (EDR) tools to hunt for process chains where a browser or downloaded application spawns unusual child processes or makes network connections to rotational domains.
4. File Analysis: Use File Analysis to inspect downloaded executables, particularly those for popular utilities sourced from outside official repositories.

Response

• Isolation: If an endpoint is found to be infected with the loader, immediately isolate it from the network to prevent further payload downloads or lateral movement.
• Full Forensics: Perform a full forensic analysis on the isolated machine. Do not assume the initial detected malware is the only threat. Actively search for evidence of other payloads (e.g., RATs, info-stealers, proxy tools).
• Credential Reset: Assume all credentials stored on or used from the compromised machine are compromised. Initiate a full password reset for the affected user and any service accounts.

Mitigation

Defending against this multi-faceted threat requires a layered security approach.

1. User Training: Conduct security awareness training focused on the dangers of downloading software from unvetted sources. Emphasize the risks of SEO poisoning and lures on social media platforms like YouTube.
2. Application Control: Implement application whitelisting or strict software policies that prevent users from installing unauthorized software. This is a key control against executing trojanized installers. This corresponds to MITRE's Execution Prevention mitigation.
3. Web Filtering: Configure web filters to block access to known malicious websites and consider restricting access to newly registered domains or less reputable TLDs like .xyz and .cfd for high-risk user groups.
4. Endpoint Protection: Ensure endpoint protection platforms (EPP/EDR) are configured to scan all downloaded files and monitor for suspicious process behavior, such as a utility installer attempting to make outbound C2 connections.
5. Network Segmentation: Segment networks to limit the ability of a compromised endpoint to communicate with critical assets. This can contain the impact of a successful infection by a RAT or other payload.