{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "This hunt addresses high-volume PPI marketplace activity that hides behind commodity loaders. Identifying these early ensures that follow-on payloads like Insomnia RAT and tunnelers are neutralized before they facilitate data theft or lateral movement." }, "name": "Commodity Loader and Multi-Payload PPI Activity", "type": "investigation", "labels": [ "hunt", "attack.t1195.002", "attack.t1190", "attack.t1059.003", "attack.t1071.001", "attack.t1568.002", "attack.t1572", "attack.t1090.003" ], "related": [ { "hunt": "seo-poisoning-detection-engineering", "reason": "This hunt focuses on the endpoint infection chain; a separate hunt should monitor the SEO poisoning domains at the network perimeter.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might alert on a filename like 'windirstat.exe', but this hunt uses a phased approach to pivot from a generic installer to rotational DNS patterns and eventually to script-based RAT execution across four different surfaces.", "coverage": [ { "stage": "initial-access-seo-and-youtube-lures", "steps": [ "scoping-lure-execution", "rotational-c2-beaconing" ], "status": "covered" }, { "stage": "dropper-execution-offerloader", "steps": [ "offerloader-temp-execution" ], "status": "covered" }, { "stage": "c2-infrastructure-beaconing", "steps": [ "rotational-c2-beaconing" ], "status": "covered" }, { "stage": "post-exploitation-payload-deployment", "steps": [ "script-based-payloads", "network-tunneling-activity" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Trojanised Software via SEO and YouTube", "slug": "initial-access-seo-and-youtube-lures", "tactic": "initial-access", "techniques": [ "T1195.002", "T1190" ], "observables": [ "atthelake.info", "noiseship.cfd", "Bluetooth Driver for Windows 10.exe", "windirstat.exe", "click_id Base64 fingerprint", "5.xxx.xx.xxx", "2.xx.xxx.xx" ] }, { "name": "OfferLoader Installation and Execution", "slug": "dropper-execution-offerloader", "tactic": "execution", "techniques": [ "T1059.003" ], "observables": [ "windirstat.tmp", "Inno Setup installer package", "Compiled Pascal [Code] section execution", "CID=2855", "CID=3075" ] }, { "name": "Rotational C2 Communication", "slug": "c2-infrastructure-beaconing", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1568.002" ], "observables": [ "voyagemist.space", "Two-word compound domain names (e.g., bubbleslip, churchpail, dinosaursjam)", ".xyz domains", ".cfd domains", ".space domains", ".info domains" ] }, { "name": "Multi-Payload PPI Deployment", "slug": "post-exploitation-payload-deployment", "tactic": "execution", "techniques": [ "T1572", "T1090.003" ], "observables": [ "Insomnia RAT (Node.js and Python)", "ARKTunnel (WebSocket tunneling)", "Docro Hijacker", "GCleaner", "Socks5Systemz", "Steganography in bitmap images" ] } ], "summary": "The CL-CRI-1171 cybercrime group operates a large-scale pay-per-install (PPI) network using YouTube gaming lures and SEO poisoning to deliver trojanized installers. Their custom dropper, OfferLoader, beacons to rotational C2 infrastructure before deploying multiple concurrent payloads including the cross-platform Insomnia RAT and the ARKTunnel WebSocket tunneling tool." }, "severity": "high", "rationale": "Focus the hunt on end-user workstations and developer machines where users might search for tools or game optimization packs. Pay special attention to Windows endpoints running Chrome or searching via SEO-poisoned terms.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is using trojanised installers to deploy a multi-stage loader that beacons to rotational C2 domains and installs follow-on backdoors like Insomnia RAT and ARKTunnel.", "parameters": { "c2_domains": { "from": { "ref": "https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/", "kind": "article", "observed": "2026-09-09" }, "type": "list[domain]", "default": [ "voyagemist.space", "atthelake.info", "noiseship.cfd" ], "description": "Known C2 domains used for initial check-ins and redirectors." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hosts to narrow the hunt; leave empty for the full estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "rat_interpreters": { "from": { "ref": "https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/", "kind": "article", "observed": "2026-09-09" }, "type": "list[string]", "default": [ "node", "python", "powershell" ], "description": "Interpreters used by payloads like Insomnia RAT and ARKTunnel." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/", "name": "Unit 42: Untracked Nightmares \u2014 The Threats Hiding Behind Commodity Infrastructure" } ], "blind_spots": [ { "id": "steganography-blind-spot", "risk": "ARKTunnel may deploy undetected if the host telemetry does not record the specific memory operations used for steganographic unpacking.", "stage": "post-exploitation-payload-deployment", "question": "Does the analyst see the ARKTunnel payload unpacking from bitmap images?", "requires": "Advanced memory inspection of image file loading" }, { "id": "no-http-body-logging", "risk": "Without deep packet inspection or full proxy logging, the decision relies on DNS and process patterns alone, missing the fingerprint that defines the campaign.", "stage": "initial-access-seo-and-youtube-lures", "question": "Can we see the Base64-encoded click_id in the HTTP traffic?", "requires": "hb_http_activity with full URI and request body logging" } ] }, "name": "Commodity Loader and Multi-Payload PPI Activity", "description": "This hunt identifies the CL-CRI-1171 cluster, which distributes malware through YouTube gaming lures and SEO poisoning. The hunt follows the infection chain from the execution of masquerading installers to the subsequent deployment of script-based payloads and network-tunneling backdoors associated with pay-per-install marketplaces." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "initial-access-seo-and-youtube-lures", "steps": [ "scoping-lure-execution", "rotational-c2-beaconing" ], "status": "covered" }, { "stage": "dropper-execution-offerloader", "steps": [ "offerloader-temp-execution" ], "status": "covered" }, { "stage": "c2-infrastructure-beaconing", "steps": [ "rotational-c2-beaconing" ], "status": "covered" }, { "stage": "post-exploitation-payload-deployment", "steps": [ "script-based-payloads", "network-tunneling-activity" ], "status": "covered" } ], "rationale": "An intruder is using trojanised installers to deploy a multi-stage loader that beacons to rotational C2 domains and installs follow-on backdoors like Insomnia RAT and ARKTunnel.", "blind_spots": [ { "id": "steganography-blind-spot", "risk": "ARKTunnel may deploy undetected if the host telemetry does not record the specific memory operations used for steganographic unpacking.", "stage": "post-exploitation-payload-deployment", "question": "Does the analyst see the ARKTunnel payload unpacking from bitmap images?", "requires": "Advanced memory inspection of image file loading" }, { "id": "no-http-body-logging", "risk": "Without deep packet inspection or full proxy logging, the decision relies on DNS and process patterns alone, missing the fingerprint that defines the campaign.", "stage": "initial-access-seo-and-youtube-lures", "question": "Can we see the Base64-encoded click_id in the HTTP traffic?", "requires": "hb_http_activity with full URI and request body logging" } ], "scoping_notes": "Focus the hunt on end-user workstations and developer machines where users might search for tools or game optimization packs. Pay special attention to Windows endpoints running Chrome or searching via SEO-poisoned terms.", "beyond_detection": "A single rule might alert on a filename like 'windirstat.exe', but this hunt uses a phased approach to pivot from a generic installer to rotational DNS patterns and eventually to script-based RAT execution across four different surfaces." } }, { "id": "scoping-lure-execution", "type": "query", "label": "Scope on lure execution", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%windirstat.exe' OR LOWER(process_name) LIKE '%bluetooth driver for windows 10.exe') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify hosts that have executed the trojanised software installers named in the research.", "expected_signal": "Rows identify specific endpoints where the malicious installers were launched. Silence suggests the specific lures in the article were not used." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope on lure execution", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%windirstat.exe' OR LOWER(process_name) LIKE '%bluetooth driver for windows 10.exe') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows identify specific endpoints where the malicious installers were launched. Silence suggests the specific lures in the article were not used.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "offerloader-temp-execution", "type": "query", "label": "OfferLoader temp file execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%.tmp' OR LOWER(process_path) LIKE '%temp%') AND LOWER(parent_process_name) LIKE '%setup%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the execution of temporary files typically created by Inno Setup in user profile paths.", "expected_signal": "Execution of a .tmp file in the Local Settings Temp directory, often spawned by an installer." }, "parents": [ { "id": "scoping-lure-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "OfferLoader temp file execution", "reads": [ "device_hostname", "process_name", "process_path", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%.tmp' OR LOWER(process_path) LIKE '%temp%') AND LOWER(parent_process_name) LIKE '%setup%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Execution of a .tmp file in the Local Settings Temp directory, often spawned by an installer.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rotational-c2-beaconing", "type": "query", "label": "Rotational C2 beaconing", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.cfd' OR LOWER(query_hostname) LIKE '%.space' OR LOWER(query_hostname) LIKE '%.xyz' OR LOWER(query_hostname) LIKE '%.info') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname HAVING lookup_count <= 100", "surface": "hb_dns_activity", "description": "Match DNS requests to the report's seed domains and identify lookups to the specific TLDs used by the rotational infrastructure.", "expected_signal": "Low-frequency DNS requests to the mentioned TLDs, potentially matching the compound word pattern described in the report." }, "parents": [ { "id": "scoping-lure-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rotational C2 beaconing", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.cfd' OR LOWER(query_hostname) LIKE '%.space' OR LOWER(query_hostname) LIKE '%.xyz' OR LOWER(query_hostname) LIKE '%.info') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname HAVING lookup_count <= 100", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Low-frequency DNS requests to the mentioned TLDs, potentially matching the compound word pattern described in the report.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "query_hostname" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Early stage triage", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "scoping-lure-execution", "offerloader-temp-execution", "rotational-c2-beaconing" ], "objective": "Determine if the process and DNS patterns match the CL-CRI-1171 initial access and loader activity.", "description": "Evaluate if the installer execution and the C2 network activity confirm the first phase of the OfferLoader intrusion.", "max_iterations": 4, "expected_signal": "A verdict on whether a host is currently compromised by the dropper.", "success_criteria": "Identify hosts compromised by the OfferLoader dropper." }, "parents": [ { "id": "offerloader-temp-execution", "kind": "merge" }, { "id": "rotational-c2-beaconing", "kind": "merge" } ] }, { "id": "script-based-payloads", "type": "query", "label": "Script-based backdoors", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT script_content, device_hostname, script_type, MIN(time) as first_seen FROM hb_script_activity WHERE instr(',' || '{{rat_interpreters}}' || ',', ',' || LOWER(script_type) || ',') > 0 AND (LOWER(script_content) LIKE '%socket%' OR LOWER(script_content) LIKE '%connect%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_content HAVING COUNT(*) < 5", "surface": "hb_script_activity", "description": "Identify Insomnia RAT behavior by searching for Node.js and Python script executions containing network-socket logic.", "expected_signal": "Script blocks performing network operations, appearing in Node.js or Python environments which are rare for standard users." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Script-based backdoors", "reads": [ "device_hostname", "script_type", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT script_content, device_hostname, script_type, MIN(time) as first_seen FROM hb_script_activity WHERE instr(',' || '{{rat_interpreters}}' || ',', ',' || LOWER(script_type) || ',') > 0 AND (LOWER(script_content) LIKE '%socket%' OR LOWER(script_content) LIKE '%connect%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_content HAVING COUNT(*) < 5", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Script blocks performing network operations, appearing in Node.js or Python environments which are rare for standard users.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "script_content" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "network-tunneling-activity", "type": "query", "label": "Network tunneling activity", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, protocol, process_name, time FROM hb_network_connection WHERE dst_endpoint_port IN (443, 80, 8080) AND (LOWER(process_name) LIKE '%node%' OR LOWER(process_name) LIKE '%python%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Identify ARKTunnel and Socks5Systemz through WebSocket or non-standard protocol tunneling connections.", "expected_signal": "Outgoing connections to web ports originating from script interpreters, which may indicate WebSocket tunneling." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Network tunneling activity", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "protocol", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, protocol, process_name, time FROM hb_network_connection WHERE dst_endpoint_port IN (443, 80, 8080) AND (LOWER(process_name) LIKE '%node%' OR LOWER(process_name) LIKE '%python%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Outgoing connections to web ports originating from script interpreters, which may indicate WebSocket tunneling.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "follow-on-analysis", "type": "analytic", "label": "Follow-on analysis", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "early-stage-triage", "script-based-payloads", "network-tunneling-activity" ], "objective": "Determine if the identified script and network patterns confirm the execution of PPI payloads following the OfferLoader compromise.", "description": "Synthesize the early-stage compromise evidence with follow-on RAT activity to confirm a successful PPI infection.", "max_iterations": 5, "expected_signal": "A detailed analysis of the infection chain from lure to final RAT payload.", "success_criteria": "A final verdict per host citing rows from both phases." }, "parents": [ { "id": "script-based-payloads", "kind": "merge" }, { "id": "network-tunneling-activity", "kind": "merge" } ] }, { "id": "ppi-infection-decision", "type": "checkpoint", "label": "PPI infection decision", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on analysis verdict is malicious for at least one host", "condition": "the follow-on analysis verdict is malicious for at least one host", "blind_spot": "no-http-body-logging", "confidence": "high", "description": "Route the hunt based on the agent's confidence in the multi-stage infection.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-analysis" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Stop the RAT beaconing and potential data theft by isolating the infected endpoint.", "instructions": "Isolate the compromised endpoint and revoke active sessions for the associated user.", "action_approval": "required" }, "parents": [ { "id": "ppi-infection-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Verify the agent's findings and document the specific RATs that were executed.", "instructions": "Review the agent's citations. Check for registry artifacts related to 'offer_execution' and persistence keys in the user profile." }, "parents": [ { "id": "ppi-infection-decision", "branch": "default" }, { "id": "ppi-infection-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Final reporting and parameter tuning.", "instructions": "Record the number of infected hosts and update the c2_domains parameter with newly discovered rotational domains." }, "parents": [ { "id": "ppi-infection-decision", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }