Infoblox Links Sable Squirrel’s Expired Domains to Streaming, Gambling and RAT C2
Summary
Infoblox reports that Sable Squirrel controls over 10,000 domains and estimates it spent more than $7 million acquiring expired domains. Its investigation links 405 domains to malware C2 and over 31,000 samples, but does not confirm ransomware execution.
Key points
- Infoblox attributes more than 10,000 domains to Sable Squirrel and estimates its expired-domain purchases exceed $7 million; it priced roughly 160 purchases at over $430,000.
- The investigation links 405 domains to malware C2, with more than 31,000 samples connecting to the actor’s domains.
- Infoblox identified Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos and njRAT samples; some samples carried HiddenTear ransomware signatures.
- Executable metadata in multiple samples contained Sable Squirrel brand names, and the samples shared configuration artifacts that Infoblox used to support its clustering.
- Some domains served streaming sites while also acting as malware C2. Infoblox says a coordinated C2 configuration wave began in November 2025 and expanded in December.
- Infoblox says Vietnamese enforcement actions in February and March 2026 did not stop the operation’s domain activity; it assesses a link to the prosecuted Xoi Lac TV network as highly likely, but not confirmed.
- Sandbox analysis of the examined HiddenTear-signature samples did not show file encryption; Infoblox does not claim confirmed ransomware execution in the wild.
Article Details
- Attack Vectors
- Sable Squirrel acquires expired domains and registers brand lookalikes, then uses the domains in its streaming, gambling, redirection, and malware infrastructure.
- From November 2025, Sable Squirrel repurposed existing streaming domains as malware C2; Infoblox identified 405 such domains and reports that December accounted for 86% of the wave.
- More than 31,000 malware samples were observed connecting to Sable Squirrel domains, including RAT families such as AsyncRAT, DCRat, and Quasar RAT. A representative Quasar sample included the actor’s streaming and betting brands in its Windows PE metadata and installed under a startup key named `xoilac`.
- Actor-controlled redirection and cloaking domains route real viewers to betting platforms while directing automated visitors and people outside the target audience to dead ends.
- ColaScore and VSBet mobile apps were published through developer accounts that Infoblox says appear to have been compromised.
- In a separate incident, Balada Injector compromised the Sable Squirrel streaming site xemlaibongda[.]net and injected code that redirected visitors to a Balada TDS URL and then to BroPush.
- Defensive Notes
- Do not treat an aged domain’s history, backlinks, or residual traffic as reliable evidence of safety: Sable Squirrel puts many acquired domains into service quickly.
- Infoblox reports a distinctive DNS fingerprint on domains it confirmed as Sable Squirrel malware infrastructure and uses it to identify related queries.
- The streaming fleet’s stock WordPress sites have been compromised by an unrelated criminal operation, which the article identifies as an exposure in the operation’s infrastructure.
- Expect domain churn and continued registration after enforcement actions; Infoblox observed new malware C2 domains appearing after the arrests.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 6789x[.]site | Actor-controlled redirection and cloaking domain used to route viewers to betting platforms. |
| DOMAIN | 90phutyy[.]io | Listed in the article’s Sable Squirrel infrastructure-domain set. |
| DOMAIN | api-score[.]com | Sable Squirrel-controlled service providing live scores and odds to its streaming sites. |
| DOMAIN | cel-robox[.]com | Sable Squirrel-controlled domain used both for an illegal streaming site and as a Quasar RAT controller. |
| DOMAIN | chatboxn[.]com | Shared live-chat backend domain used by Sable Squirrel streaming sites. |
| DOMAIN | colascore[.]com | Domain for a betting platform that Infoblox assesses Sable Squirrel owns or controls. |
| DOMAIN | colatv88xb[.]cc | Sable Squirrel C2 domain that accounted for nearly 70% of exposed customer networks in the reported set. |
| DOMAIN | gvapi[.]cc | Sable Squirrel proxy content-delivery domain used to mirror sports imagery and match-result content. |
| DOMAIN | imgts[.]com | Sable Squirrel server domain used to deliver images and page assets across streaming brands. |
| DOMAIN | koepgd[.]app | Domain in the dedicated streaming-server pool serving video for Sable Squirrel sites. |
| DOMAIN | lfastcdn[.]com | Sable Squirrel server domain used to deliver images and page assets across streaming brands. |
| DOMAIN | meung[.]app | Domain in the dedicated streaming-server pool serving video for Sable Squirrel sites. |
| DOMAIN | msdht[.]app | Domain in the dedicated streaming-server pool serving video for Sable Squirrel sites. |
| DOMAIN | msrktz[.]app | Domain in the dedicated streaming-server pool serving video for Sable Squirrel sites. |
| DOMAIN | refvsb[.]com | Listed in the article’s Sable Squirrel infrastructure-domain set. |
| DOMAIN | socoliveku[.]cc | Listed in the article’s Sable Squirrel infrastructure-domain set. |
| DOMAIN | sportliveapiz[.]com | Sable Squirrel-controlled sports-data feed used across its streaming brands. |
| DOMAIN | trackervsb[.]live | Listed as Sable Squirrel infrastructure; the article describes actor-controlled tracker domains across the operation. |
| DOMAIN | vsbet276[.]com | Domain for a betting platform that Infoblox assesses Sable Squirrel owns or controls. |
| DOMAIN | ws-xyz[.]com | WebSocket service domain used by the streaming sites’ live chat. |
| DOMAIN | xemlaibongda[.]net | Compromised Sable Squirrel streaming site where Balada Injector injected code that redirected visitors to its TDS. |
| DOMAIN | xoilacxys[.]top | Domain reported to have hosted a financial scam targeting Russian-speaking users; the article suspects a registrar-account compromise and says it no longer resolves. |
| DOMAIN | xoilacz[.]com | Sable Squirrel streaming domain; the article says it shares the operation’s common streaming backend. |
| SHA256 | 0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216 | Representative Quasar RAT sample associated with Sable Squirrel in the article’s indicators list. |
| URL | hxxps[:]//bind[.]bestresulttostart[.]com/xf4mKQ | Balada Injector TDS URL reached through code injected into the compromised xemlaibongda[.]net site. |
MITRE ATT&CK
T1547.001 · Registry Run Keys / Startup FolderA representative Quasar RAT sample installs itself under a startup key named `xoilac`.T1583.001 · DomainsSable Squirrel acquires expired domains and registers brand-lookalike domains for its streaming, redirection, gambling, and malware infrastructure.T1586.003 · Cloud AccountsColaScore and VSBet apps were published through Google Play developer accounts that Infoblox says appear to have been compromised.T1659 · Content InjectionBalada Injector injected code into the compromised xemlaibongda[.]net site, redirecting its visitors to a TDS.
Threat Actors
Malware
AsyncRATWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.DCRatWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.HiddenTearWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.NanoCoreWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.njRATWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.Quasar RATWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.RemcosWe identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures.
Vendors
DropCatchInfoblox Threat Intel | Dropcatch series | Part 2 of 3Dynadotbuys expired domains at auction, through platforms such as DropCatch[.]com, GoDaddy, Namecheap, and Dynadot, specifically to inherit what those domains already have: aged registration history, real inboundGoDaddySable Squirrel buys expired domains at auction, through platforms such as DropCatch[.]com, GoDaddy, Namecheap, and Dynadot, specifically to inherit what those domains already have: aged registration history, realGoogleThe actor publishes the ColaScore and VSBet mobile apps on Google Play, and does so through developer accounts that appear to be compromised.NamecheapSable Squirrel buys expired domains at auction, through platforms such as DropCatch[.]com, GoDaddy, Namecheap, and Dynadot, specifically to inherit what those domains already have: aged registration history, real
Products
Google PlayThe actor publishes the ColaScore and VSBet mobile apps on Google Play, and does so through developer accounts that appear to be compromised.WordPressThe opsec issues cut both ways though: because every streaming site runs on stock WordPress, Sable Squirrel’s own sites are a soft target, and we have watched at least one of them get compromised by an unrelated
Tools
Countries
Australiawith large Vietnamese-speaking populations, including South Korea, Taiwan, Singapore, Japan, and Australia.ChinaThe same conventions reach beyond Vietnam and China.Japanlist of countries with large Vietnamese-speaking populations, including South Korea, Taiwan, Singapore, Japan, and Australia.Singaporea short list of countries with large Vietnamese-speaking populations, including South Korea, Taiwan, Singapore, Japan, and Australia.South Koreaaccess to Vietnam and a short list of countries with large Vietnamese-speaking populations, including South Korea, Taiwan, Singapore, Japan, and Australia.TaiwanVietnam and a short list of countries with large Vietnamese-speaking populations, including South Korea, Taiwan, Singapore, Japan, and Australia.VietnamVietnam is a center of gravity in our data, but it does not appear to be the boundary of the operation.
Industries
BankingEducation made up the largest share, roughly one in five, followed by information technology and consulting at about one in seven, and then government, healthcare, and banking.ConsultingEducation made up the largest share, roughly one in five, followed by information technology and consulting at about one in seven, and then government, healthcare, and banking.EducationEducation made up the largest share, roughly one in five, followed by information technology and consulting at about one in seven, and then government, healthcare, and banking.GamblingSable Squirrel spends millionsâ¯on expired domains toâ¯deliver illegal gambling, streaming, RAT malware, and ransomwareâ¯inâ¯a massive cybercriminal enterprise.GovernmentSable Squirrel has acquired domains previously owned by real organizations that range from press outlets, charities, government and civic campaigns, well-known brands, and academic institutions.HealthcareEducation made up the largest share, roughly one in five, followed by information technology and consulting at about one in seven, and then government, healthcare, and banking.Information TechnologyEducation made up the largest share, roughly one in five, followed by information technology and consulting at about one in seven, and then government, healthcare, and banking.Sports streamingdomain history into its own criminal infrastructure, then using that infrastructure to run illegal sports streaming, online gambling promotion, and malware command-and-control (C2) side by side.