Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure
Source AlienVault OTX General
Description
A massive cybercrime campaign tracked as CL-CRI-1171 has operated undetected for at least two years, utilizing a pay-per-install marketplace to distribute multiple malware families. The operation targeted primarily young gamers through YouTube channels with hundreds of thousands of followers, while simultaneously using SEO poisoning to compromise corporate endpoints including critical infrastructure and government entities. The campaign employed OfferLoader, a custom loader capable of delivering unique payload combinations through sophisticated gating mechanisms. Three distinct malware families were identified: Insomnia RAT, a cross-platform backdoor targeting Windows and macOS; ARKTunnel, a WebSocket tunneling tool hidden via steganography; and Docro Hijacker, a Chrome browser hijacker. Over 10,000 distinct loader samples were discovered, indicating a much larger deployment campaign affecting numerous organizations globally.
Impact
The campaign compromises both individual users (primarily young gamers) and high-value corporate and government targets, potentially enabling unauthorized remote access, data exfiltration, browser hijacking, and covert network tunneling. The use of multiple malware families and sophisticated delivery mechanisms increases the complexity and potential impact of infections. The widespread scale indicated by thousands of loader samples suggests significant exposure across various sectors.
Defensive guidance
No specific patch or remediation is indicated for this campaign as it involves multiple malware families distributed via a pay-per-install marketplace. Organizations should focus on user education to recognize phishing and SEO poisoning tactics, implement endpoint protection capable of detecting the identified malware families, and monitor for indicators of compromise related to OfferLoader and associated payloads. Since this is a large-scale campaign without a single software vulnerability, mitigation centers on detection and prevention controls rather than patching.
MITRE ATT&CK techniques
- T1189Drive-by Compromise · Initial Access (opens in a new tab)
- T1566.002Phishing: Spearphishing Link · Initial Access (opens in a new tab)
- T1053.005Scheduled Task/Job: Scheduled Task · Execution, Persistence, Privilege Escalation (opens in a new tab)
- T1059.001Command and Scripting Interpreter: PowerShell · Execution (opens in a new tab)
- T1059.006Command and Scripting Interpreter: Python · Execution (opens in a new tab)
Indicators of compromise
Domains 298
- basesfile.com
- uy.basesfiles.com
- dolldebt.xyz
- fangbear.xyz
- memorycompany.xyz
- suitsoap.xyz
- truckshat.xyz
- boatthought.xyz
- territorycaption.xyz
- reasonachiever.xyz
URLs 2
- http://drelto.info/farlix
- http://stryper.info/aa.js