Skip to content
Threat Feed
Subscribe

Actor

CL-CRI-1171

1 brief RSS
high threat

CL-CRI-1171 Pay-Per-Install Infrastructure and Malware Campaign

The CL-CRI-1171 threat actor operates a large-scale pay-per-install marketplace, leveraging SEO poisoning and YouTube gaming lures to deploy a persistent multi-payload loader used to distribute malware including Insomnia RAT and ARKTunnel.

WinDirStat CL-CRI-1171 ppi malware seo-poisoning loader remote-access-trojan c2
1r 2t 5i