Insomnia RAT: A Dual-Payload Backdoor

Insomnia RAT is a dual-payload backdoor consisting of a Node.js and a Python payload that targets both Windows and macOS systems. The RAT was named and first documented as “Insomnia RAT” by Palo Alto Networks Unit 42 in September 2026, although its Node.js component is an evolution of a backdoor previously reported on by Walmart Global Tech in 2025. Unit 42 observed Insomnia RAT being distributed as part of a campaign associated with the cybercrime CL-CRI-1171. The operation uses a pay-per-install (PPI) model, in which an operator compromises systems and provides other threat actors with the ability to deploy their own payloads onto those already-compromised machines.

From OfferLoader to Insomnia RAT

Insomnia RAT is one of several payloads distributed through OfferLoader, the custom loader associated with cybercrime group CL-CRI-1171. In the infection chain analyzed by Unit 42, a trojanized installer ultimately launches three separate payload branches corresponding to Insomnia RAT, ARKTunnel, and Docro Hijacker, respectively. The Insomnia RAT branch begins with eld0.exe, which drops a.dll and launches a hidden PowerShell process responsible for downloading and executing t.ps1, the PowerShell loader script analyzed in this blog. t.ps1 is in charge of preparing the system for the deployment of Insomnia RAT’s Node.js and Python components. The two agents provide the attacker with a backup access mechanism to the compromised system; the Python agent provides an additional access mechanism, allowing the operators to potentially retain access if the Node.js component or its runtime is discovered or otherwise removed.

Analyzing the PowerShell Loader

We analyzed the PowerShell loader identified in the original report: SHA256: The script performs much of the setup needed to deploy and maintain the dual-payload backdoor. Our analysis identified behavior related to runtime installation, payload retrieval, defense evasion, and persistence.

Runtime and Payload Deployment

The script installs the legitimate Node.js and Python runtime environments required by the two Insomnia RAT agents. The Node.js component, aa.js, is retrieved from:

hxxps[:]//stryper[.]info/aa[.]js

The Python component is retrieved from:

hxxps[:]//aa[.]amazingshield[.]xyz/33244556546[.]py

The Python payload is subsequently stored using a GUID-based .py filename. By bringing the required runtime environments onto the compromised machine, the RAT does not depend on those runtimes already being present on the compromised system.

Persistence

The PowerShell loader establishes persistence through scheduled tasks designed to resemble legitimate Microsoft activity. The Node.js component is persisted through Maps Performance Task, which executes hourly and at system startup. The Python agent is separately persisted through OOBETaskScheduler, created under \Microsoft\Windows\Servicing. This provides independent persistence mechanisms for the two Insomnia RAT components. Task names observed during our analysis include:

Maps Performance Task
Tpm-HASCertRenew
OOBETaskScheduler

Microsoft Defender Tampering

The PowerShell loader also makes several changes intended to weaken Microsoft Defender protections and reduce the visibility of security notifications. Among the registry modifications observed in the sample:

SpyNetReporting is set to 0, disabling Microsoft Defender MAPS reporting.
The entire C:\ drive is added under Windows Defender\Exclusions\Paths, effectively excluding it from Defender scanning.
SubmitSamplesConsent is set to 2, preventing automatic sample submission.
NoToastApplicationNotification is enabled to suppress application notifications.
DisableNotificationCenter is enabled to disable the Windows Notification Center.
DisableNotifications is configured under Defender Security Center notification policies to further disable alerting.

Detecting Insomnia RAT

The combination of behavior exposed by the PowerShell loader makes it a strong candidate for YARA-based detection. Rather than relying on generic artifacts, the rule combines indicators from several parts of the infection chain:

Insomnia RAT payload infrastructure
Distinctive scheduled task names
Node.js and Python deployment artifacts
Microsoft Defender and security-notification tampering

Combining these independent characteristics provides greater specificity while making detection less dependent on a single IOC.

YARA Rule

rule Insomnia_RAT_PS_Loader {
    meta:
        author = "Evelyne Diaz Araque ([email protected])"
        date = "2026-10-01"
        description = "Detects PS with Insomnia RAT setup logic from the CL-CRI-1171 operation reported on by Unit 42."
        ref = "https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/"
        hash = "ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e"

    strings:
        // Node.js component of Insomnia RAT
        $s0 = "https://stryper.info/aa.js" base64

        // Python payload
        $s1 = "https://aa.amazingshield.xyz/33244556546.py" ascii

        // Python domain
        $d0 = "https://aa.amazingshield.xyz" ascii

        // Scheduled tasks
        $task0 = "Maps Performance Task" ascii
        $task1 = "Tpm-HASCertRenew" ascii
        $task2 = "OOBETaskScheduler" ascii

        // Disabling Windows Defender
        $def0 = "DisableNotificationCenter" ascii
        $def1 = "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications" ascii
        $def2 = "NoToastApplicationNotification" ascii

    condition:
        (1 of ($s*) or $d0) and
        (2 of ($task*)) and
        (2 of ($def*))
}

Scanning Stairwell’s Corpus

Scanning this rule against Stairwell’s multi-petabyte malware corpus identified an additional sample containing the same combination of Insomnia RAT setup behaviors. SHA256: ecf508d91f7e3b17a7211e5e8d48739158cd75844f2caaf9792f95ce7d17516f

Indicators of Compromise (IOCs)

SHA256 Hashes

ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e – Insomnia RAT PowerShell loader documented by Unit 42.
ecf508d91f7e3b17a7211e5e8d48739158cd75844f2caaf9792f95ce7d17516f – Variant identified with our YARA rule.

Persistence Artifacts

Maps Performance Task
Tpm-HASCertRenew
OOBETaskScheduler

Insomnia RAT: A Dual-Payload Backdoor