CL-CRI-1171
CL-CRI-1171 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It uses 2 MITRE ATT&CK techniques.
- Techniques
- 2
- Exploited CVEs
- No CVE data
- First seen
- Jun 1, 2025
- Last seen
- Jun 1, 2026
- Record updated
About CL-CRI-1171.
CL-CRI-1171 is a financially motivated cybercrime activity cluster assessed to operate a pay-per-install infection service. The cluster uses gaming-oriented video channels, SEO-poisoned software-download lures, disposable domains and gated delivery infrastructure to route victims to OfferLoader, which installs multiple unrelated payloads for downstream criminal customers. Public reporting describes a sustained operation with more than 10,000 loader samples and over 200 rotating hostnames. CL-CRI-1171 remains an activity-cluster designation rather than a fully attributed named group. Observed infections in enterprise, government and critical-infrastructure environments do not by themselves establish strategic sector targeting. The reported activity window is month-level; structured first- and last-seen timestamps are normalized to month starts.
Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.