CL-CRI-1171 Uses YouTube and SEO Lures to Distribute Three Malware Families
Summary
Unit 42 traced a pay-per-install operation using gaming videos and SEO-poisoned downloads to spread OfferLoader and deliver Insomnia RAT, ARKTunnel and Docro Hijacker. Researchers identified over 10,000 loader samples.
Key points
- CL-CRI-1171 has operated for at least two years, using YouTube channels and SEO-poisoned software downloads to route victims through a shared pay-per-install infrastructure.
- The OfferLoader trojanized installers used gated downloads and rotational domains; researchers identified more than 10,000 distinct loader samples.
- Insomnia RAT deploys Node.js and Python backdoors, disables Windows Defender protections, and establishes persistence with scheduled tasks.
- ARKTunnel is a WebSocket tunneling RAT extracted from a bitmap using steganography; it supports TCP and UDP tunneling and file execution.
- Docro Hijacker bypasses Chrome’s Secure Preferences integrity check to install an extension that hijacks searches and can rewrite or redirect results.
- Unit 42 linked 11 YouTube channels to the operation and reported that they were taken down after notification.
Article Details
- Attack Vectors
- Trojanized software installers, including a Bluetooth driver and WinDirStat, delivered through SEO-poisoning results and fake file-hosting pages.
- Gaming-optimization YouTube videos directed viewers through burner blogs and intermediary links to the PPI gate and malware downloads.
- OfferLoader used fresh click_id fingerprints to selectively deliver payloads while showing scanners and analysts decoy pages or broken links.
- OfferLoader launched independent payloads, including Insomnia RAT, ARKTunnel, and Docro Hijacker.
- Insomnia RAT used a PowerShell loader to download and execute Node.js and Python agents, disable Windows Defender protections, and establish scheduled-task persistence.
- ARKTunnel was extracted from a BMP image using LSB steganography and installed as a Windows service; it supports TCP and UDP tunneling and file execution.
- Docro Hijacker bypassed Chrome Secure Preferences integrity checks, installed a browser extension, changed the default search provider, and rewrote search-result network requests.
- Defensive Notes
- The article recommends Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR, and XSIAM for protection and detection.
- Cortex defenses described in the article include YARA signatures for OfferLoader and staged payloads, behavioral detection for malicious Chrome extension setup and untrusted service installations, and detection of trojanized installer execution patterns.
- Investigate seemingly routine loader infections because OfferLoader can deliver multiple independent payloads and uses gating mechanisms that may evade automated URL scanners.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aa[.]amazingshield[.]xyz | Host for the Insomnia RAT Python agent. |
| DOMAIN | achievershelf[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | activitymeal[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | additionplot[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | adex-blog[.]blogspot[.]com | Attacker-created burner blog used in the YouTube malware-delivery funnel. |
| DOMAIN | adviceturn[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | afternoonscrew[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | agreementjuice[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | airplaneiron[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | airtwig[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | amountfuel[.]icu | CL-CRI-1171 gate/landing domain. |
| DOMAIN | animalrecord[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | animalview[.]xyz | Domain used to confirm OfferLoader installations. |
| DOMAIN | apparatustruck[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | apparelplate[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | archairport[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | atthelake[.]info | SEO-poisoning referring domain identified in the campaign's click_id data. |
| DOMAIN | authoritykittens[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | babyvein[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | badgewing[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | bagcare[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | basesfile[.]com | Sibling fake file-hosting lure in the campaign's SEO delivery infrastructure. |
| DOMAIN | basinpleasure[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | basketballyear[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | baskethumor[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | bedroomdesire[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | beliefpicture[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | bellplayground[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | bikesdonkey[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | birthdaymagic[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | boardmagic[.]info | Domain used to confirm OfferLoader installations. |
| DOMAIN | boatthought[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | boundarychickens[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | boytank[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | branchmorning[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | breathdoctor[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | bubbleslip[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | cabbagemeasure[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | cablecanvas[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | cardgrape[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | cattlegold[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | celeryerror[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | centscarf[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | chalkprose[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | chawton[.]info | PPI affiliate install-tracker domain. |
| DOMAIN | cherriestruck[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | chesstail[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | chickensmine[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | churchpail[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | clothcrib[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | clothcurrent[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | coatberry[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | collartitle[.]info | Domain used to confirm OfferLoader installations. |
| DOMAIN | connect[.]activitykitty[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]apparatustaste[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]armcard[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]badgeterritory[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]baitmetal[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]beefteeth[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]believesisters[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]boundaryfly[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]bubbleappliance[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]cableland[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]chinexpert[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]conditiongrade[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]coppersummer[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]creatorcreator[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]dresstent[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]dropjeans[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]edgeplayground[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]exchangeclub[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]existencediscussion[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]expansionsalt[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]fangstitch[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]fogparcel[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]foodhook[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]forkcountry[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]fuelleg[.]info | Domain used to confirm OfferLoader installations. |
| DOMAIN | connect[.]geesepurpose[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]giantsdogs[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]giraffetoothpaste[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]guitarrobin[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]halllunch[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]harborclam[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]holecompany[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]knifesea[.]icu | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]monthsmoke[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]nosegovernor[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]pagesubstance[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]poisonblade[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]prosesalt[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]purposethings[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]quiltgirls[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]reactionbit[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]rewardrun[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]riceapparel[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]seashoreletters[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]selectiondogs[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]shapeboot[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]shoptax[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]stopfinger[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]structurekiss[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]tanksuggestion[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]thingbrass[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]thoughtslave[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]threadfuel[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]trailcontrol[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]trickbushes[.]info | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]vacationthought[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]viewschool[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]voyagelaugh[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]woolreward[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]yearicicle[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | connect[.]zebratransport[.]xyz | CL-CRI-1171 install-tracker domain. |
| DOMAIN | controlprice[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | coughcoal[.]icu | CL-CRI-1171 gate/landing domain. |
| DOMAIN | countrypipe[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | cowsfoot[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | crackfood[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | creamfurniture[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | creditchickens[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | crediteducation[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | crimestreet[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | crimesupport[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | crowdstri[.]com | Typosquat C2 domain used by the Insomnia RAT Python agent. |
| DOMAIN | curvebite[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | deathrock[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | deathshop[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | decisionreaction[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | dinosaursjam[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | distancebedroom[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | distributiontheory[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | dolldebt[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | doorsoap[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | drelto[.]info | Host for the Docro Hijacker script injected into search results. |
| DOMAIN | dustprotest[.]icu | CL-CRI-1171 gate/landing domain. |
| DOMAIN | dw[.]xrsdownload[.]com | SEO file-locker lure host. |
| DOMAIN | expansionsalt[.]info | CL-CRI-1171 gate/landing and install-tracker domain. |
| DOMAIN | extentrack[.]com | Docro Hijacker affiliate install-tracker and callback host. |
| DOMAIN | fallbeginner[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | fangbear[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | filescenter[.]cloud | CL-CRI-1171 gate/landing domain. |
| DOMAIN | filescloud[.]pro | SEO file-locker lure host. |
| DOMAIN | filesilo[.]cloud | CL-CRI-1171 gate/landing domain. |
| DOMAIN | filexstorage[.]site | SEO file-locker lure host. |
| DOMAIN | finersto[.]com | Docro Hijacker extension installation and start-telemetry host. |
| DOMAIN | fingerbasketball[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | flavorwood[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | fleshfrog[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | fleshplants[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | fleshproduce[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | foodrock[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | forkmice[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | friendjewel[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | geeseairport[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | girlsgrain[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | glassmove[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | goldsteel[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | governmentyard[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | grandfatherquiver[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | gripcollar[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | gripsleep[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | gunbear[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | hairreward[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | hatescale[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | healthiron[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | holemuscle[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | homecub[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | homefireman[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | honeyfear[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | igk[.]filexspace[.]com | SEO file-locker lure host. |
| DOMAIN | ikx[.]filexspace[.]com | SEO file-locker lure host. |
| DOMAIN | ilesilo[.]cloud | CL-CRI-1171 gate/landing domain. |
| DOMAIN | instrumentvolcano[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | kittenschalk[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | kittensgrade[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | kittensrobin[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | landerror[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | lesilo[.]cloud | CL-CRI-1171 gate/landing domain. |
| DOMAIN | liptendency[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | liquidtoes[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | liquidwrench[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | lockettrail[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | lumberbaseball[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | memorycompany[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | micesisters[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | mifilesx[.]site | SEO file-locker lure host. |
| DOMAIN | milkname[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | minewave[.]info | Domain used to confirm OfferLoader installations. |
| DOMAIN | minuteblade[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | mountainsurprise[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | mouthfruit[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | mqsearch[.]com | Search-provider domain set by Docro Hijacker. |
| DOMAIN | needcherries[.]online | Domain used to confirm OfferLoader installations. |
| DOMAIN | noiseship[.]cfd | SEO-poisoning domain distributing a trojanized WinDirStat installer. |
| DOMAIN | northbox[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | partpipe[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | partyfriends[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | passengerbrake[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | peacejewel[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | peacetongue[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | petminister[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | pictureporter[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | pieplant[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | pizzasthread[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | placespoon[.]xyz | Domain used to confirm OfferLoader installations. |
| DOMAIN | pleasurewaves[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | popcornregret[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | porterdebt[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | powerbushes[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | profitfact[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | prosetoothbrush[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | quincepage[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | raintexture[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | rakepurpose[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | raterake[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | ravexoffical[.]blogspot[.]com | Attacker-created burner blog used in the YouTube malware-delivery funnel. |
| DOMAIN | readingscience[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | reasonachiever[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | recessgiraffe[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | recordhistory[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | reg[.]pcsdkflyer[.]ca | C2 server address for the ARKTunnel WebSocket RAT. |
| DOMAIN | regretsquirrel[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | restbucket[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | ricestar[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | rifledog[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | ringsparcel[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | roadyear[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | rockcredit[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | rollglass[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | roofbattle[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | roofreaction[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | rosegrip[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | routeletters[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | runhouses[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | scarecrowcare[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | scentrod[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | screwbirth[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | seatlace[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | seaword[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | servantadvice[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | shiptank[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | shirtexample[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | shoesearthquake[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | sinkwash[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | skirtloss[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | slipvegetable[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | smokecar[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | songtheory[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | spadeleg[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | sparkrice[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | sparkrub[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | spoonducks[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | springdogs[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | spybaseball[.]space | CL-CRI-1171 gate/landing domain. |
| DOMAIN | startmonkey[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | statementservant[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | statementtouch[.]xyz | PPI affiliate install-tracker and gate/landing domain. |
| DOMAIN | steamhouses[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | stopzinc[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | storage[.]ggclicker[.]com | SEO file-locker and referrer host. |
| DOMAIN | structurelinen[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | stryper[.]info | Host for the Insomnia RAT PowerShell installer and Node.js agent. |
| DOMAIN | suggestioncemetery[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | suitsoap[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | suitstraw[.]info | Domain used to confirm OfferLoader installations. |
| DOMAIN | swimrest[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | tablechess[.]info | CL-CRI-1171 gate/landing domain. |
| DOMAIN | tailsilk[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | territorycaption[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | texturebadge[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | thrillducks[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | throneback[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | tinsofa[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | toespiders[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | toothpastesense[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | toothpastesun[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | townquiver[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | trampdonkey[.]icu | CL-CRI-1171 gate/landing domain. |
| DOMAIN | treesboard[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | trickflag[.]info | Domain used to confirm OfferLoader installations. |
| DOMAIN | truckpig[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | truckshat[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | turnclass[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | umbrellavessel[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | uy[.]basesfiles[.]com | Fake file-hosting lure in the campaign's SEO delivery infrastructure. |
| DOMAIN | vacationengine[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | velfps[.]blogspot[.]com | Attacker-created burner blog used in the YouTube malware-delivery funnel. |
| DOMAIN | velvoxlab[.]blogspot[.]com | Attacker-created burner blog used in the YouTube malware-delivery funnel. |
| DOMAIN | vendralo[.]info | Docro Hijacker infrastructure used to deliver per-victim UUIDs, rewriting rules, and extension updates. |
| DOMAIN | venrx[.]blogspot[.]com | Attacker-created burner blog used in the YouTube malware-delivery funnel. |
| DOMAIN | venrx[.]xyz | Custom-domain burner site used in the YouTube malware-delivery funnel. |
| DOMAIN | venrxhub[.]blogspot[.]com | Attacker-created burner blog used in the YouTube malware-delivery funnel. |
| DOMAIN | vesselsystem[.]xyz | Domain used to confirm OfferLoader installations. |
| DOMAIN | vestthings[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | volcanopin[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | voyagemist[.]space | PPI affiliate install-tracker beacon and OfferLoader gate/landing domain. |
| DOMAIN | wastereading[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | wasteturkey[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | wastewine[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | watchadvance[.]com | SEO-poisoning domain in the campaign infrastructure. |
| DOMAIN | wavepan[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | whistlebook[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | whistlesong[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | wormspark[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | woundsecretary[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | wrenobservation[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | yamsmell[.]xyz | CL-CRI-1171 gate/landing domain. |
| DOMAIN | yardvalue[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | zephyrhall[.]cfd | CL-CRI-1171 gate/landing domain. |
| DOMAIN | zippyfiles[.]net | SEO file-locker lure host. |
| SHA256 | 06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5 | Additional ARKTunnel resource-icon hash listed in the indicators. |
| SHA256 | 25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5 | Hash of the unpacked Insomnia RAT loader stage, eld0.tmp. |
| SHA256 | 2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354 | Hash of the Docro Hijacker installer, eld2.exe. |
| SHA256 | 3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961 | Hash of the Insomnia RAT initial loader, eld0.exe. |
| SHA256 | 553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104 | Hash of the unpacked Docro Hijacker installer stage, eld2.tmp. |
| SHA256 | 62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e | Hash of the Node.js-based component of the Insomnia RAT dual payload. |
| SHA256 | 7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c | Hash of a trojanized WinDirStat installer carrying OfferLoader. |
| SHA256 | 9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69 | Hash of a.dll, which executes the PowerShell downloader for Insomnia RAT stages. |
| SHA256 | aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1 | Hash of the ARKTunnel LSB-steganography dropper, eld1.exe. |
| SHA256 | b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c | Hash of wscl.exe, the ARKTunnel WebSocket tunneling RAT. |
| SHA256 | ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e | Hash of the Insomnia RAT PowerShell loader, t.ps1. |
| SHA256 | cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de | Hash of a Python-based component of the Insomnia RAT dual payload. |
| SHA256 | d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf | Hash of a resource icon shared across ARKTunnel samples. |
| SHA256 | e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d | Hash of the ZIP archive carved from the ARKTunnel BMP steganography payload. |
| SHA256 | fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73 | Hash of the unpacked WinDirStat OfferLoader stage. |
| SHA256 | fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007 | Hash of Adblock.dll, which bypasses Chrome integrity checks and installs the Docro extension. |
| URL | hxxp[:]//aa[.]amazingshield[.]xyz/33244556546[.]py | Insomnia RAT Python agent download URL. |
| URL | hxxps[:]//stryper[.]info/aa[.]js | Insomnia RAT Node.js agent download URL. |
| URL | hxxps[:]//stryper[.]info/t[.]ps1 | Insomnia RAT PowerShell installer download URL. |
MITRE ATT&CK
T1027.003 · SteganographyThe ARKTunnel dropper extracted its payload archive from a BMP image using LSB steganography.T1036 · MasqueradingPayloads were disguised as legitimate utilities and installers, and ARKTunnel used fabricated corporate identities in PE metadata.T1053.005 · Scheduled TaskInsomnia RAT established persistence using scheduled tasks configured to run hourly and at startup.T1059.001 · PowerShellInsomnia RAT's t.ps1 script downloaded and installed its Node.js and Python agents.T1105 · Ingress Tool TransferThe loader and its stages downloaded payloads, scripts, and agent components from attacker infrastructure.T1112 · Modify RegistryThe installer modified the registry to hide Node.js from the Add/Remove Programs list.T1176 · Software ExtensionsDocro Hijacker installed a Chrome extension that rewrote network requests and manipulated search results.T1204.002 · Malicious FileUsers were induced to download and execute trojanized utility installers and gaming optimization packages.T1562.001 · Disable or Modify ToolsThe Insomnia RAT PowerShell installer disabled Windows Defender protections and added the C:\ drive as an exclusion.T1572 · Protocol TunnelingARKTunnel provides TCP and UDP tunneling through its WebSocket-based RAT.
Threat Actors
Malware
ARKTunnelby the same loader between July 2025 and April 2026: two never publicly reported, Docro Hijacker and ARKTunnel, and a new variant of a previously unnamed backdoor, which we dubbed Insomnia remote access Trojan (RAT).Docro Hijackerpayloads delivered by the same loader between July 2025 and April 2026: two never publicly reported, Docro Hijacker and ARKTunnel, and a new variant of a previously unnamed backdoor, which we dubbed Insomnia remoteGCleanerA subsequent infection, observed in June 2026, delivered two entirely different payloads: GCleaner and Socks5Systemz.Insomnia RATThey shared a single loader that delivered three separate malware families: Insomnia RAT, ARKTunnel and Docro Hijacker.OfferLoaderAlthough the observed rotation appears to be highly structured, the discovery of over 10,000 unique OfferLoader samples points to a much larger distribution pipeline.Socks5SystemzA subsequent infection, observed in June 2026, delivered two entirely different payloads: GCleaner and Socks5Systemz.
Vendors
GoogleWhen the victim performs an internet search, across any of more than 190 Google country-code domains, the extension loads a script from drelto[.]info/farlix into the search results page.Palo Alto NetworksPalo Alto Networks customers are better protected from the threats discussed in this article through the following:
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS SecurityAdvanced URL FilteringAdvanced URL Filtering and Advanced DNS SecurityAdvanced WildFireAdvanced WildFireCortex XDRCortex XDR and XSIAMGoogle ChromeChromeInno SetupOfferLoader – The delivery mechanism behind all recorded intrusions, an Inno Setup trojanized installer that sets up the other payloads.Node.jsTargeting both Windows and macOS using Node.js, paired with a twin Python agent.WinDirStatBoth events involved trojanized software downloads — one a Bluetooth driver, the other WinDirStat — and both affected machines executed an identical post-exploitation chain.Windows Defenderhidden PowerShell process to download and execute t.ps1. This double-stage installer script disables Windows Defender protections, adds the entire C:\ drive as an exclusion, suppresses security notifications andWinRARthe actor’s infrastructure: scanners, crawlers or analysts receive a decoy clone of the legitimate WinRAR download page or broken links.XSIAMCortex XDR and XSIAM
Tools
Industries
Critical infrastructureThe SEO funnel targeted a more professional audience, promoting trojanized software that resulted in malware deployment on corporate endpoints, including critical infrastructure and even government entities.GamingThese channels were actively interacting with viewers to promote gaming content laced with links to download malware.GovernmentThe SEO funnel targeted a more professional audience, promoting trojanized software that resulted in malware deployment on corporate endpoints, including critical infrastructure and even government entities.