Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

0
Medium
Published: 09/09/2026 (09/09/2026, 11:07:49 UTC)
Source: AlienVault OTX General

Description

The CL-CRI-1171 cybercrime campaign has operated undetected for at least two years, distributing multiple malware families via a pay-per-install marketplace. It primarily targeted young gamers through popular YouTube channels and used SEO poisoning to compromise corporate and critical infrastructure endpoints. The campaign employed a custom loader called OfferLoader to deliver payloads including Insomnia RAT, ARKTunnel, and Docro Hijacker. Over 10,000 loader samples indicate a large-scale operation affecting numerous organizations globally.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/09/2026, 13:08:25 UTC

Technical Analysis

CL-CRI-1171 is a long-running cybercrime campaign that leverages a pay-per-install marketplace to distribute multiple malware families. It targets young gamers via YouTube channels with large followings and uses SEO poisoning techniques to infect corporate endpoints, including critical infrastructure and government entities. The campaign uses OfferLoader, a custom loader with sophisticated gating mechanisms, to deliver unique payload combinations. Identified malware includes Insomnia RAT (a cross-platform backdoor for Windows and macOS), ARKTunnel (a WebSocket tunneling tool hidden via steganography), and Docro Hijacker (a Chrome browser hijacker). The discovery of over 10,000 distinct loader samples suggests a widespread deployment.

Potential Impact

The campaign compromises both individual users (primarily young gamers) and high-value corporate and government targets, potentially enabling unauthorized remote access, data exfiltration, browser hijacking, and covert network tunneling. The use of multiple malware families and sophisticated delivery mechanisms increases the complexity and potential impact of infections. The widespread scale indicated by thousands of loader samples suggests significant exposure across various sectors.

Defensive Guidance

No specific patch or remediation is indicated for this campaign as it involves multiple malware families distributed via a pay-per-install marketplace. Organizations should focus on user education to recognize phishing and SEO poisoning tactics, implement endpoint protection capable of detecting the identified malware families, and monitor for indicators of compromise related to OfferLoader and associated payloads. Since this is a large-scale campaign without a single software vulnerability, mitigation centers on detection and prevention controls rather than patching.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/"]
Adversary
CL-CRI-1171
Pulse Id
6aa13e05864a561a7db38073
Threat Score
null

Indicators of Compromise

Domain

ValueDescriptionCopy
domainbasesfile.com
domainuy.basesfiles.com
domaindolldebt.xyz
domainfangbear.xyz
domainmemorycompany.xyz
domainsuitsoap.xyz
domaintruckshat.xyz
domainboatthought.xyz
domainterritorycaption.xyz
domainreasonachiever.xyz
domaindeathshop.xyz
domainscrewbirth.xyz
domainflavorwood.xyz
domainwormspark.xyz
domainwrenobservation.xyz
domainclothcrib.xyz
domainricestar.xyz
domaincoatberry.xyz
domainnorthbox.xyz
domaincentscarf.xyz
domainroadyear.xyz
domainrifledog.xyz
domainbeliefpicture.xyz
domainwhistlesong.xyz
domainmicesisters.xyz
domaintrampdonkey.icu
domaingripsleep.xyz
domainpizzasthread.xyz
domainbedroomdesire.xyz
domainlanderror.xyz
domainspringdogs.xyz
domainturnclass.xyz
domainstructurelinen.xyz
domainadviceturn.xyz
domainfallbeginner.xyz
domainrunhouses.xyz
domainpopcornregret.xyz
domaindistancebedroom.xyz
domainanimalrecord.xyz
domainroofreaction.xyz
domaintoothpastesense.xyz
domaindecisionreaction.xyz
domainwastereading.xyz
domainholemuscle.xyz
domainboytank.xyz
domaincreditchickens.xyz
domaintailsilk.xyz
domaintoespiders.xyz
domaintreesboard.xyz
domaincreamfurniture.space
domainceleryerror.xyz
domaingrandfatherquiver.xyz
domainmountainsurprise.cfd
domainpeacetongue.xyz
domaincrackfood.space
domainwoundsecretary.xyz
domainglassmove.xyz
domainapparelplate.space
domainarchairport.xyz
domainsparkrice.space
domaincrimestreet.xyz
domaingeeseairport.xyz
domainmilkname.xyz
domainbranchmorning.xyz
domainbabyvein.xyz
domainwastewine.xyz
domainbellplayground.xyz
domainseatlace.space
domainhomefireman.xyz
domaininstrumentvolcano.space
domainthroneback.xyz
domainairplaneiron.xyz
domainapparatustruck.xyz
domaincablecanvas.xyz
domainliquidtoes.xyz
domainlockettrail.xyz
domainprofitfact.xyz
domainrakepurpose.xyz
domainservantadvice.xyz
domaincattlegold.xyz
domainbikesdonkey.info
domainrecessgiraffe.xyz
domaintruckpig.cfd
domainhealthiron.space
domaincontrolprice.xyz
domainraterake.cfd
domaintrickflag.info
domainpartyfriends.cfd
domainspybaseball.space
domainpictureporter.cfd
domaincrediteducation.cfd
domaincherriestruck.space
domainafternoonscrew.space
domainrockcredit.space
domainbagcare.space
domaintownquiver.xyz
domainpassengerbrake.space
domaingunbear.xyz
domainbirthdaymagic.xyz
domainyamsmell.xyz
domainbasketballyear.xyz
domainyardvalue.cfd
domaindinosaursjam.cfd
domainachievershelf.space
domainchickensmine.space
domainbadgewing.xyz
domainmouthfruit.cfd
domainigk.filexspace.com
domainrecordhistory.xyz
domainchurchpail.xyz
domainspadeleg.xyz
domainpieplant.space
domainfoodrock.space
domainprosetoothbrush.xyz
domainroofbattle.xyz
domainquincepage.xyz
domainsmokecar.space
domainrouteletters.xyz
domainliquidwrench.cfd
domaintexturebadge.xyz
domainshiptank.cfd
domainstatementtouch.xyz
domainswimrest.xyz
domainhomecub.cfd
domainforkmice.xyz
domainregretsquirrel.xyz
domainzephyrhall.cfd
domainfriendjewel.cfd
domaincountrypipe.space
domainwasteturkey.xyz
domainpowerbushes.xyz
domainsteamhouses.cfd
domainvoyagemist.space
domaintoothpastesun.xyz
domainauthoritykittens.info
domainbaskethumor.xyz
domainspoonducks.cfd
domainbubbleslip.xyz
domainvolcanopin.xyz
domainwhistlebook.cfd
domainactivitymeal.space
domainsinkwash.space
domainkittenschalk.xyz
domaingovernmentyard.cfd
domaindistributiontheory.cfd
domainrosegrip.xyz
domaindoorsoap.cfd
domaincrimesupport.cfd
domainbreathdoctor.xyz
domainstartmonkey.cfd
domainsparkrub.xyz
domainshoesearthquake.xyz
domainfilesilo.cloud
domainatthelake.info
domainreg.pcsdkflyer.ca
domainaa.amazingshield.xyz
domainextentrack.com
domainnoiseship.cfd
domainikx.filexspace.com
domainfilexstorage.site
domainfilescloud.pro
domainzippyfiles.net
domainmifilesx.site
domaindw.xrsdownload.com
domainstorage.ggclicker.com
domainwatchadvance.com
domainanimalview.xyz
domainsuitstraw.info
domainconnect.fuelleg.info
domainvesselsystem.xyz
domainminewave.info
domaincollartitle.info
domainboardmagic.info
domainplacespoon.xyz
domainneedcherries.online
domainvenrx.xyz
domainadditionplot.cfd
domainagreementjuice.space
domainairtwig.xyz
domainamountfuel.icu
domainbasinpleasure.xyz
domainboundarychickens.xyz
domaincabbagemeasure.xyz
domaincardgrape.xyz
domainchalkprose.xyz
domainchesstail.xyz
domainclothcurrent.xyz
domainconnect.activitykitty.xyz
domainconnect.apparatustaste.xyz
domainconnect.armcard.xyz
domainconnect.badgeterritory.xyz
domainconnect.baitmetal.xyz
domainconnect.beefteeth.xyz
domainconnect.believesisters.xyz
domainconnect.boundaryfly.xyz
domainconnect.bubbleappliance.xyz
domainconnect.cableland.xyz
domainconnect.chinexpert.xyz
domainconnect.conditiongrade.xyz
domainconnect.coppersummer.xyz
domainconnect.creatorcreator.xyz
domainconnect.dresstent.xyz
domainconnect.dropjeans.xyz
domainconnect.edgeplayground.xyz
domainconnect.exchangeclub.xyz
domainconnect.existencediscussion.info
domainconnect.expansionsalt.info
domainconnect.fangstitch.xyz
domainconnect.fogparcel.info
domainconnect.foodhook.info
domainconnect.forkcountry.xyz
domainconnect.geesepurpose.xyz
domainconnect.giantsdogs.info
domainconnect.giraffetoothpaste.xyz
domainconnect.guitarrobin.xyz
domainconnect.halllunch.info
domainconnect.harborclam.xyz
domainconnect.holecompany.info
domainconnect.knifesea.icu
domainconnect.monthsmoke.info
domainconnect.nosegovernor.xyz
domainconnect.pagesubstance.xyz
domainconnect.poisonblade.xyz
domainconnect.prosesalt.xyz
domainconnect.purposethings.info
domainconnect.quiltgirls.xyz
domainconnect.reactionbit.info
domainconnect.rewardrun.xyz
domainconnect.riceapparel.xyz
domainconnect.seashoreletters.info
domainconnect.selectiondogs.xyz
domainconnect.shapeboot.info
domainconnect.shoptax.xyz
domainconnect.stopfinger.info
domainconnect.structurekiss.xyz
domainconnect.tanksuggestion.xyz
domainconnect.thingbrass.xyz
domainconnect.thoughtslave.xyz
domainconnect.threadfuel.xyz
domainconnect.trailcontrol.xyz
domainconnect.trickbushes.info
domainconnect.vacationthought.xyz
domainconnect.viewschool.xyz
domainconnect.voyagelaugh.xyz
domainconnect.woolreward.xyz
domainconnect.yearicicle.xyz
domainconnect.zebratransport.xyz
domaincoughcoal.icu
domaincowsfoot.xyz
domaincurvebite.xyz
domaindeathrock.xyz
domaindustprotest.icu
domainexpansionsalt.info
domainfilescenter.cloud
domainfingerbasketball.xyz
domainfleshfrog.xyz
domainfleshplants.xyz
domainfleshproduce.xyz
domaingirlsgrain.xyz
domaingoldsteel.cfd
domaingripcollar.xyz
domainhairreward.xyz
domainhatescale.info
domainhoneyfear.xyz
domainilesilo.cloud
domainkittensgrade.cfd
domainkittensrobin.info
domainlesilo.cloud
domainliptendency.info
domainlumberbaseball.xyz
domainminuteblade.xyz
domainpartpipe.xyz
domainpeacejewel.xyz
domainpetminister.xyz
domainpleasurewaves.info
domainporterdebt.xyz
domainraintexture.xyz
domainreadingscience.xyz
domainrestbucket.xyz
domainringsparcel.xyz
domainrollglass.xyz
domainscarecrowcare.xyz
domainscentrod.info
domainseaword.xyz
domainshirtexample.xyz
domainskirtloss.xyz
domainslipvegetable.xyz
domainsongtheory.xyz
domainstatementservant.xyz
domainstopzinc.xyz
domainsuggestioncemetery.xyz
domaintablechess.info
domainthrillducks.xyz
domaintinsofa.xyz
domainumbrellavessel.xyz
domainvacationengine.xyz
domainvestthings.cfd
domainwavepan.xyz

Hash

ValueDescriptionCopy
hashaaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1
hash62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e
hash3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961
hash7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c
hashfc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73
hash25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5
hash9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69
hashceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e
hashcf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de
hashe05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d
hashb367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c
hashd8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf
hash06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5
hash2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354
hash553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104
hashfdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007
hash10b70b533d0b8e1436eacf19f64a292c
hash3e231b0233b0fce425e7db8222d9b813
hasha1120c3670aa25d725b39962d2501192
hasha586a2d3390bb3afacbee8e97efdc45a
hashc09b2825a3f91856d2b74e9786d04986
hashd7fc598f88c5abaf225ee77a2a5e0852
hash066c6692e1c27be769a51ae15c14e2b022bf380d
hash20e5cd757cffa0c8fb1b4d50a11682bd2080d613
hash9a143d2b9d1c3c71edf299460d1be5653596b3a1
hash9bde4c8d85402cf00cc5a8b4b71ac8bb2e32bfe1
hash9f831da1e656e0ef92ad26845e3230f26336e503
hashc0b003b3af873a3b1af117912ae31b462abd743e

Url

ValueDescriptionCopy
urlhttp://drelto.info/farlix
urlhttp://stryper.info/aa.js

Threat ID: 6aa1568cacd9273b49564f89

Added to database: 09/09/2026, 12:52:28 UTC

Last enriched: 09/09/2026, 13:08:25 UTC

Last updated: 09/09/2026, 22:22:00 UTC

Views: 12

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses