Loading threat actor…
CL-CRI-1171 is a financially motivated cybercrime cluster operating a pay-per-install malware-distribution service since at least 2024. It uses gaming-focused YouTube channels, search-engine optimization poisoning, fake software-download pages, and trojanized installers masquerading as game-performance tools, drivers, and legitimate utilities. The operation primarily lures gamers but has also affected enterprise, critical-infrastructure, and government endpoints. The cluster’s shared OfferLoader component is an Inno Setup-based loader that profiles prospective victims and uses gated delivery to distinguish likely targets from automated analysis systems. It can serve decoy content or nonfunctional downloads to scanners and researchers, while selectively deploying modular payloads to validated victims. This model enables the operator to monetize a compromised device through multiple downstream criminal customers and change payload bundles without replacing the initial lure. Observed OfferLoader payloads include Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner, and Socks5Systemz. Insomnia RAT is a Windows and macOS backdoor with Node.js and Python components that collects host information, receives commands, downloads files, returns execution output, impairs Microsoft Defender protections, and establishes scheduled-task persistence. ARKTunnel is a WebSocket-based remote-access tool that uses steganographic payload concealment, establishes service-based persistence, tunnels TCP and UDP traffic, and executes files. Docro Hijacker bypasses Chrome Secure Preferences integrity controls to alter search-provider settings and install a malicious browser extension capable of modifying search results, redirecting traffic, and manipulating affiliate links for monetization.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
335 indicators attributed to this actor. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.