Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.
Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.
- CL-CRI-1171 runs a pay-per-install marketplace delivering unrelated buyers' payloads through one shared loader
- Infection funnels abused 11 YouTube gaming channels and SEO poisoning promoting trojanized software like WinDirStat
- Loader delivered Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz from July 2025 to April 2026
- Over 10,000 distinct loader samples and 200+ rotational C2 domains across .xyz, .cfd, .space and .info TLDs
- Victims included young gamers, corporate endpoints, critical infrastructure and government entities
- ATT&CK
- T1204.002 User Execution: Malicious FileT1036.005 Masquerading: Match Legitimate Name or LocationT1583.001 Acquire Infrastructure: DomainsT1585.002 Establish Accounts: Social Media Accounts
- Products
- WinDirStatGCleaner
- Threat actors
- CL-CRI-1171
- Organizations
- Palo Alto NetworksUnit 42YouTube
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amazingshield.xyz | , redundant agent. This Python script is downloaded from aa.amazingshield[.]xyz . The installer downloads a legitimate Python distributio |
| domain | atthelake.info | rring SEO Domain Search Keyword Victim IP Windows_10 Chrome atthelake[.]info hwidspoofer 5.xxx.xx.xxx Windows_10 Chrome atthelake[.]in |
| domain | crowdstri.com | hostname and processor architecture. The Python agent used crowdstri[.]com as its C2 domain. This appears to be a deliberate typosqu |
| domain | extentrack.com | t extracts and runs eld2.tmp which contacts the affiliate’s extentrack[.]com install tracker. eld2.tmp drops and loads Adblock.dll , w |
| domain | mqsearch.com | : Search hijacking : Changes the default search provider to mqsearch[.]com , a domain that masquerades as a search engine Extension |
| domain | noiseship.cfd | h affiliate ID CID=2855 . Second intrusion set : Browsed to noiseship[.]cfd , a domain registered just 39 days earlier, and downloade |
| domain | pcsdkflyer.ca | ling, as well as file execution. The C2 server address, reg.pcsdkflyer[.]ca , is decoded from a 39-byte configuration blob using Base |
| domain | stryper.info | rst part of Insomnia RAT is a Node.js agent downloaded from stryper[.]info/aa.js . While the prior variant targeted Windows, Linux a |
| domain | voyagemist.space | This temporary file transmits an initial tracking beacon to voyagemist[.]space . This is another gating mechanism: depending on the stru |
From the original article
13 min read at unit42.paloaltonetworks.com
An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42.
By Rem Dudas · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.