Overview of the CL-CRI-1171 Pay-Per-Install Campaign
Unit 42 has unveiled a massive, previously untracked cybercrime campaign, identified as CL-CRI-1171, that has operated for at least two years by leveraging seemingly unremarkable commodity infrastructure. This operation functions as a pay-per-install (PPI) service, allowing various threat actors to deploy their diverse malware payloads indiscriminately across a broad victim base. The campaign targets both individual gamers through malicious YouTube content and professional audiences, including corporate endpoints, critical infrastructure, and government entities, via SEO poisoning. The common denominator linking these disparate infections is a custom, generic loader designed to evade scrutiny, masking the subsequent deployment of distinct malware families, according to Unit 42.
The CL-CRI-1171 Pay-Per-Install Model and Infrastructure
The CL-CRI-1171 cluster operates an infection service where initial access to compromised machines is auctioned to multiple buyers. Each buyer can then deploy their own independent payloads through the same dropper. This PPI model allows a single initial infection to conceal numerous unrelated malware payloads on the same endpoint, each with its own command-and-control (C2) infrastructure and objectives. The custom loader used in this campaign is disposable and generic, a deliberate design choice that has allowed it to operate under the radar, frequently dismissed as commodity adware.
The investigation revealed a sprawling network of over 200 unique rotational domains, following a distinctive two-word compound naming pattern (e.g., bubbleslip, churchpail, dinosaursjam) and rotating across various top-level domains (TLDs) such as .xyz, .cfd, .space, and .info. This shared infrastructure and consistent use of the same loader, coupled with the rotational domain pattern, indicate a single, sustained operation.
Infection Vectors and Targeted Audiences
CL-CRI-1171 utilizes at least two primary funneling mechanisms to route traffic to its malware landing pages:
-
Malicious YouTube Channels: The campaign involved at least eleven YouTube channels with hundreds of thousands of followers, which have since been terminated after Unit 42’s notification. These channels actively interacted with viewers, promoting gaming content (e.g., advice on improving frame rates, fixing game crashes, adjusting settings) while embedding links to download malicious tools. This method primarily targeted young gamers.
-
SEO Poisoning: This vector targeted a more professional audience. Unsuspecting users searching for legitimate software would encounter SEO-poisoned results leading to trojanized downloads, such as a malicious Bluetooth driver or a compromised WinDirStat utility. This led to malware deployment on corporate endpoints, including those within critical infrastructure and government entities. Organisations seeking to mitigate SEO poisoning malware campaigns must be vigilant about software download sources.
Identified Malware Payloads
Between July 2025 and April 2026, the CL-CRI-1171 infrastructure delivered several distinct malware families. While the source dates seem to refer to future observations, the campaign’s historical activity indicates a continuous deployment capability. Initial investigations identified three key payloads:
- Insomnia Remote Access Trojan (RAT): A previously unnamed backdoor, now dubbed Insomnia RAT, enabling remote control and data exfiltration.
- ARKTunnel: A new, publicly unreported tunneling tool.
- Docro Hijacker: Another novel and publicly unreported malware designed for hijacking system functions.
Subsequent infections observed later in 2026 delivered entirely different payloads, including GCleaner and Socks5Systemz, highlighting the dynamic nature of PPI networks. The discovery of over 10,000 unique loader samples indicates a much larger distribution pipeline, suggesting the loader has likely delivered numerous other malware families. Security teams seeking to understand how to detect Insomnia RAT deployment or other associated malware should focus on the initial loader’s characteristics and C2 communications.
Actionable Recommendations for Defenders
Organisations must prioritize a multi-layered defense strategy to counter threats posed by campaigns like CL-CRI-1171. Effective CL-CRI-1171 detection strategies involve:
- Endpoint Detection and Response (EDR)/Extended Detection and Response (XDR): Implement and maintain EDR/XDR solutions to detect unusual process execution, anomalous network connections, and suspicious file modifications that might indicate the presence of the generic loader or its deployed payloads.
- Network Monitoring: Continuously monitor network traffic for C2 communication patterns associated with known CL-CRI-1171 infrastructure, especially connections to unusual or recently registered TLDs (e.g., .xyz, .cfd, .space, .info). Pay close attention to outbound connections from endpoints to untrusted or newly observed domains.
- User Education and Awareness: Conduct regular security awareness training, emphasizing the risks of downloading software from unverified sources, clicking suspicious links in gaming content, or trusting unofficial search results for critical applications. Encourage users to only download software from official vendor websites.
- Software Supply Chain Security: Verify the integrity and authenticity of all downloaded software, especially for critical enterprise tools. Implement application whitelisting where feasible to prevent the execution of unauthorized binaries.
- Threat Intelligence Integration: Leverage up-to-date threat intelligence to identify and block known indicators of compromise (IOCs) associated with CL-CRI-1171, including its rotational domains and known malware hashes.
Related: MODBEACON RAT: Silver Fox Uses gRPC for Stealthy C2