CL-CRI-1171 Cybercrime Operation Targets Gamers and Enterprises

• •CL-CRI-1171 is a two-year cybercrime operation targeting gamers and enterprises.
• •The operation uses a pay-per-install model to distribute malware via YouTube and SEO manipulation.
• •Three distinct malware strains have been identified: Insomnia RAT, ARKTunnel, and Docro Hijacker.

Unit 42 and Broadcom report on the CL-CRI-1171 cybercrime operation, a two-year scheme utilizing a pay-per-install marketplace to distribute malware targeting both young gamers and corporate networks. The operation leverages manipulated search engine results and popular gaming YouTube channels to deliver infections. The primary delivery mechanism, OfferLoader, has propagated three distinct malware strains: Insomnia RAT, ARKTunnel, and Docro Hijacker. The campaign has compromised numerous consumer systems and sensitive enterprise networks, with over 10,000 distinct loader samples identified. YouTube channels promoting gaming content were used as a delivery vehicle for malware, prompting their termination. The malware strains include a cross-platform backdoor, a WebSocket tunneling tool, and a browser-hijacking tool. Current protective measures include advanced URL filtering and DNS security from Palo Alto Networks and Symantec. The operation remains active, with ongoing risks for affected users.