CL-CRI-1171 Pay-Per-Install Infrastructure and Malware Campaign

CL-CRI-1171 is a cybercrime group operating a pay-per-install (PPI) marketplace that facilitates the distribution of diverse malware payloads to enterprise and home networks. The group has been active since at least 2024, utilizing a shared loader infrastructure to deploy various secondary payloads, including the previously unreported Docro Hijacker, ARKTunnel, and the Insomnia RAT. The delivery infrastructure is highly evasive, employing a gate mechanism that fingerprints potential victims using parameters like operating system, browser, and referring URL. Requests that do not match expected criteria are served decoys, effectively blinding automated security scanners and analysts. This infrastructure facilitates the rotational deployment of unrelated malware families, ensuring the operator can monetize access to thousands of compromised endpoints, ranging from consumer gaming PCs to government and critical infrastructure workstations. The campaign is notable for its use of SEO poisoning and high-follower YouTube gaming channels, which provide a consistent stream of human traffic to the malicious delivery funnels.

Attack Chain

1. Attacker establishes a funnel via YouTube gaming channels and SEO-poisoned pages for legitimate software like WinDirStat or Bluetooth drivers.
2. Victim navigates to a malicious landing page, triggering a fake virus-scan animation to build credibility.
3. The landing page gate performs client-side fingerprinting and validates the victim environment via a click_id parameter.
4. Upon validation, the gate serves a generic, trojanized installer (the OfferLoader) to the victim.
5. The installer executes and reaches out to rotational C2 domains to fetch additional payloads.
6. The loader drops secondary stage agents, such as PowerShell scripts or DLLs, designed to facilitate further persistence and download multi-stage agents (Node.js/Python).
7. Final stage payloads (e.g., Insomnia RAT, ARKTunnel) initiate C2 communication to exfiltrate data or establish remote access.

Impact

The campaign has resulted in at least 10,000 distinct loader deployments, affecting organizations across government and critical infrastructure sectors. Successful infections provide unauthorized remote access and the ability to deploy arbitrary additional malware, leading to potential data exfiltration, long-term persistence, and the sale of access to other malicious actors via the PPI marketplace.

Recommendation

• Deploy the provided detection rules to identify suspicious process execution chains associated with generic installers and PowerShell-based staging.
• Implement egress filtering to block the rotational C2 domain patterns and known bad domains identified in this brief at the DNS level.
• Monitor for unsigned or inconsistently signed installers masquerading as legitimate utilities like WinDirStat, particularly those originating from non-official domains.
• Investigate endpoints for the presence of PowerShell scripts downloading from external non-reputable domains, focusing on the file patterns identified in the technical analysis.