Affected Systems

Enterprise networks, critical infrastructure, and government entities. Campaign CL-CRI-1171 active since at least 2024, delivering payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz via custom loader. Over 10,000 distinct loader samples identified. Targets include gamers and corporate users seeking trojanized software (Bluetooth drivers, WinDirStat, gaming tools).

Exploitation Status

Active exploitation confirmed. Campaign operational for at least two years (2024-2026). Multiple YouTube channels with hundreds of thousands of followers actively distributing malware until termination. SEO poisoning funnel targeting corporate endpoints. Over 200 rotational C2 domains identified across .xyz, .cfd, .space, and .info TLDs.

Business Impact

Pay-per-install marketplace enables multiple threat actors to deploy independent payloads through single infection vector, complicating detection and response. Generic loader design evades scrutiny, appearing as commodity adware. Infections observed at critical infrastructure and government entities. Multiple unrelated malware families delivered simultaneously to same endpoint, each with separate C2 infrastructure. Campaign scale (10,000+ loader variants) suggests widespread compromise potential across enterprise environments.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block known CL-CRI-1171 C2 domains using two-word compound pattern across .xyz, .cfd, .space, and .info TLDs (examples: bubbleslip, churchpail, dinosaursjam) via DNS filtering and firewall rules
  • Hunt for Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz indicators in endpoints using EDR telemetry, focusing on trojanized software downloads (WinDirStat, Bluetooth drivers, gaming utilities)
  • Review web proxy logs for YouTube gaming channel referrals and SEO-poisoned search results leading to software download sites between July 2025 and present
  • Deploy Advanced WildFire, Advanced URL Filtering, and Cortex XDR signatures for CL-CRI-1171 loader and associated payloads if using Palo Alto Networks infrastructure
  • Implement application control policies to block execution of unsigned or low-reputation executables downloaded from gaming-related or software utility sites