Squirrel Threat Cluster Weaponizes Dropcatch/Expired Domains for RAT C2, SocGholish and Streaming-Gambling Fraud

Key facts for Squirrel streaming RAT cluster

Detection coverage for Squirrel streaming RAT cluster

As of 2026-08-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2022 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery

Detects HTTP/HTTPS requests from internal hosts to known Sable/Shady/Stuffy Squirrel dropcatch domains (aged, high-trust corporate/brand domains re-registered to inherit residual reputation) combined with fake browser-update lure patterns in the URI path, consistent with SocGholish drive-by delivery restored ~10 days after the June 2026 Operation Endgame takedown, and Sable Squirrel streaming/gambling front redirection.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1608.004, T1204.002, T1656, T1583.001
• Data sources: proxy, web_proxy, dns
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="proxy:access"
(dest_domain IN ("cel-robox.com","xemlaibongda.net","xoilacxys.top","healthymagination.com","krogeralbertsons.com","rezilion.com","maxfactor-international.com","snsystems.com","veinteractive.com","advanceslibrary.com","blacksaltys.com","cdnjslibraries.com","simplejscdn.com","gsstats.ru","weatherplllatform.com","magesource.su","tofuturepubs.com"))
| eval fake_update_lure=if(match(uri_path, "(?i)(update|updater|out[-_]?of[-_]?date|browser[-_]?update|flash[-_]?player)"), 1, 0)
| stats count as hits, values(uri_path) as paths, values(http_user_agent) as user_agents, earliest(_time) as first_seen, latest(_time) as last_seen by src_ip, user, dest_domain, fake_update_lure
| where hits > 0
| sort - hits

Microsoft KQL

let SquirrelDropcatchDomains = dynamic(["cel-robox.com","xemlaibongda.net","xoilacxys.top","healthymagination.com","krogeralbertsons.com","rezilion.com","maxfactor-international.com","snsystems.com","veinteractive.com","advanceslibrary.com","blacksaltys.com","cdnjslibraries.com","simplejscdn.com","gsstats.ru","weatherplllatform.com","magesource.su","tofuturepubs.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (SquirrelDropcatchDomains)
| extend FakeUpdateLure = RemoteUrl matches regex @"(?i)(update|updater|out-of-date|browser-update|flash-player)"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, FakeUpdateLure, InitiatingProcessFileName
| summarize Hits=count(), Paths=make_set(RemoteUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName, RemoteIP
| order by Hits desc

Sigma

title: Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery
id: 7c3f2a10-9d41-4e5a-9c2b-11e8f4a2b001
status: experimental
description: Detects web requests to known Sable/Shady/Stuffy Squirrel dropcatch domains reviving aged corporate/brand reputations to deliver SocGholish-style fake browser-update lures and drive-by malware.
references:
    - https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/
    - https://securityaffairs.com/197251/uncategorized/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-15
tags:
    - attack.reconnaissance
    - attack.t1596.001
    - attack.resource-development
    - attack.t1583.001
    - attack.initial-access
    - attack.t1656
    - attack.execution
    - attack.t1204.002
    - attack.t1608.004
    - malware.socgholish
logsource:
    category: proxy
    product: generic
detection:
    selection_domain:
        c-uri-host|contains:
            - 'cel-robox.com'
            - 'xemlaibongda.net'
            - 'xoilacxys.top'
            - 'healthymagination.com'
            - 'krogeralbertsons.com'
            - 'rezilion.com'
            - 'maxfactor-international.com'
            - 'snsystems.com'
            - 'veinteractive.com'
            - 'advanceslibrary.com'
            - 'blacksaltys.com'
            - 'cdnjslibraries.com'
            - 'simplejscdn.com'
            - 'gsstats.ru'
            - 'weatherplllatform.com'
            - 'magesource.su'
            - 'tofuturepubs.com'
    selection_lure:
        cs-uri-stem|contains:
            - 'update'
            - 'browser-update'
            - 'out-of-date'
            - 'flash-player'
    condition: selection_domain or selection_lure
falsepositives:
    - Legitimate software update pages that coincidentally share URI keywords (rare given the domain allowlist restricts most false positives)
level: high

Known false positives:

• Legitimate corporate domains that share naming patterns with the dropcatch list before being confirmed re-registered (verify WHOIS/registrant change date)
• Internal QA/monitoring tools that legitimately crawl or health-check the listed domains

Tuning notes: Refresh the dropcatch domain allowlist against threat_iocs/osint_context on a rolling basis (Sable Squirrel weaponizes 76% of acquisitions within 7 days); narrow the fake_update_lure regex per environment to cut noise from legitimate software-update portals.

• 🔒 Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery · unlock with TL Creds
• 🔒 Multi-RAT Registry Run-Key Persistence with Squirrel-Cluster Brand Metadata · unlock with TL Creds
• 🔒 RAT C2 Beaconing to Squirrel Dropcatch and Community-Corroborated Sibling Infrastructure · unlock with TL Creds
• 🔒 Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery · unlock with TL Creds
• 🔒 Multi-RAT Registry Run-Key Persistence with Squirrel-Cluster Brand Metadata · unlock with TL Creds
• 🔒 RAT C2 Beaconing to Squirrel Dropcatch and Community-Corroborated Sibling Infrastructure · unlock with TL Creds
• 🔒 Multi-RAT Registry Run-Key Persistence with Squirrel-Cluster Brand Metadata · unlock with TL Creds
• 🔒 RAT C2 Beaconing to Squirrel Dropcatch and Community-Corroborated Sibling Infrastructure · unlock with TL Creds

Indicators of compromise for Squirrel streaming RAT cluster

As of 2026-08-15, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-2022.

Sample indicators (3 of 33)

• Domain: cel-robox[.]com
• File hash: 0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216
• Domain: colatv88xb[.]cc

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

How Squirrel streaming RAT cluster works

Infoblox Threat Intel's multi-part 'dropcatch' research (published 2026-08-14, covered by Security Affairs on 2026-08-15) documents 65,000 expired domains being re-registered daily across gTLDs and ccTLDs in H1 2026 (~19-20% of all new registrations), concentrated in 15 TLDs. These 'dropcatch' domains retain residual web traffic, backlinks, cached search rankings, email forwarding and lingering DNS/CNAME records from their prior owners, giving buyers instant, laundered trust that new domains lack. Once re-registered, 24% of dropcatch domains are weaponized the same day, 76% within 7 days, and 94% within two weeks.

Four distinct but related actor clusters exploit this pattern. Sable Squirrel (active since at least June 2023, epicenter Vietnam, overlapping the dismantled Xoi Lac TV pirate-streaming network) has spent over $7M on 10,000+ domains -- including aged, high-trust corporate domains such as healthymagination[.]com (GE), krogeralbertsons[.]com, maxfactor-international[.]com (P&G), snsystems[.]com (former Sony PlayStation dev tools) and rezilion[.]com (cybersecurity firm later acquired by GitLab) -- and runs them as illegal sports-streaming brands (Xoilac, Cakhia, 90phut, Socolive, MiTom, ColaTV), online-gambling platforms (VSBet, ColaScore, 8xbet, 6686), and, since November 2025, RAT command-and-control: 405 C2-configured domains and 31,000+ malware samples communicating with them, delivering AsyncRAT 0.5.8, Quasar RAT, DCRat, NanoCore, Remcos RAT, njRAT and non-executing HiddenTear signatures. Malware samples embed the operator's own streaming/gambling brand names in binary metadata (CompanyName 'socoLIVE', ProductName 'xoilac', LegalTrademarks '8xbet') and Windows Run-key persistence, directly linking the malware to the streaming/gambling infrastructure. Roughly 12% of Infoblox's enterprise customers queried Sable Squirrel C2 domains, concentrated in education, IT/consulting, government, healthcare and banking.

Stuffy Squirrel (active since 2020, 500+ domains), Shady Squirrel (Russian-speaking, active since July 2023, 700+ domains) and Swiping Squirrel (active since 2022, 3,000+ domains) instead scavenge domains previously compromised by other intrusion actors (TA2726, Magecart, Balada Injector) and simply inherit the residual infected-site traffic rather than compromising sites themselves. All three run multi-layer cloaking (URL-path matching, server-side TDS filtering, referrer checks, user-interaction gating) so automated scanners see benign content while real visitors are redirected through Keitaro TDS instances into tech-support scams, SocGholish fake-browser-update malware, and zero-click ad-fraud platforms (ZeroPark, PushHouse, ExoClick). Shady Squirrel notably re-enabled SocGholish delivery via a newly registered domain (advanceslibrary[.]com, registered 2026-06-27) roughly ten days after the June 2026 Operation Endgame takedown seized 300+ SocGholish servers and 140 domains, restoring a live fake-update payload by 2026-07-10. Shady Squirrel separately ran an April-July 2026 tech-support-scam operation abusing 10,000+ Microsoft Azure static-web-hosting accounts monthly to display fake Microsoft security warnings with call-center phone numbers targeting Japan and the U.S.

Infoblox's underlying finding: security tooling that grants trust based on domain age, aged backlinks or historical reputation is systematically exploitable by this dropcatch pattern, and orphaned/dangling DNS CNAME records left behind by decommissioned services are a related, compounding hijacking vector (roughly a third of identified dangling CNAMEs were trivially takeable).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools

Execution

T1204.002 User Execution: Malicious File

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1584.001 Compromise Infrastructure: Domains; T1608.001 Stage Capabilities: Upload Malware; T1608.004 Stage Capabilities: Drive-by Target

Reconnaissance

T1596.001 Search Open Technical Databases: DNS/Passive DNS

stealth

T1684.001 Impersonation

Remediation for Squirrel streaming RAT cluster

Immediate actions

• Block/alert on DNS resolution and network egress to the identified Sable/Stuffy/Shady/Swiping Squirrel domain IOCs
• Audit outbound traffic for connections to newly re-registered ('dropcatch') domains, especially ones resolving within days of a WHOIS/registrar change
• Inventory and remove dangling CNAME/DNS records pointing to decommissioned, expired, or third-party-hosted resources the organization no longer controls

Workarounds

• User-awareness training on fake browser-update prompts (SocGholish) and unsolicited tech-support pop-ups/call-center numbers
• Block known Sable Squirrel streaming/gambling and Shady Squirrel tech-support-scam phone numbers and redirect chains at the web proxy where cloaked redirection is suspected

Longer-term hardening

• Enable registrar auto-renewal and pre-expiration alerting for all organization-owned domains, including retired legacy/brand/campaign domains that are no longer actively used but still carry brand trust
• Deploy continuous DNS hygiene monitoring to detect orphaned CNAME/A records before the underlying domain or cloud resource lapses
• Reduce reliance on raw domain-age/historical-reputation signals in web-filtering and email-security tooling; treat aged domains that recently changed registrant/nameservers as elevated risk
• Formally deprovision DNS entries and notify downstream integrators when decommissioning a domain or cloud-hosted service

Affected and fixed versions

• Domain registration ecosystem (GoDaddy, Namecheap, DropCatch.com, Dynadot) — Expired/lapsed domain registrations acquired via dropcatch
  Vulnerable versions: Any domain permitted to lapse and become available for third-party re-registration, particularly aged domains carrying residual reputation, backlinks, cached search rankings, or lingering DNS/CNAME records
  Fixed in: N/A - mitigated operationally via registrar auto-renewal, active domain-portfolio monitoring, and DNS/CNAME record cleanup at decommissioning, not a vendor patch
• Multiple prior domain owners (General Electric, Procter & Gamble, Kroger-Albertsons, Sony, Rezilion/GitLab, veinteractive) — Previously-owned corporate/brand domains that lapsed and were re-registered by Sable Squirrel
  Vulnerable versions: healthymagination[.]com, maxfactor-international[.]com, krogeralbertsons[.]com, snsystems[.]com, rezilion[.]com, veinteractive[.]com and similar lapsed brand domains
  Fixed in: N/A - domains were not renewed by their original owners

Timeline of Squirrel streaming RAT cluster

• 2020-01-01 Stuffy Squirrel begins operating dropcatch/scavenger domain infrastructure (first of three infrastructure generations).
• 2022-01-01 Swiping Squirrel begins acquiring dropcatch domains to sell traffic into zero-click ad-fraud platforms.
• 2023-06-01 Sable Squirrel activity begins, epicentered in Vietnam and overlapping the Xoi Lac TV illegal sports-streaming network.
• 2023-07-01 Shady Squirrel begins operating Russian-speaking dropcatch/scavenger infrastructure feeding tech-support scams and locked-ioc-29.
• 2025-10-12 Sable Squirrel begins early testing of locked-ioc-27 on dropcatch domain infrastructure.
• 2025-11-01 First locked-ioc-30 0.5.8 sample observed communicating with Sable Squirrel C2 infrastructure; first C2 configurations appear on dropcatch domains.
• 2025-12-01 Mass C2 deployment wave: 86% of Sable Squirrel's identified malware-C2-configured domains go live.
• 2026-02-01 Xoi Lac TV flagship illegal-streaming properties frozen amid an organized-crime enforcement action in Vietnam.
• 2026-03-01 30 suspects charged and roughly 300 billion VND (~$12M) in assets seized in the Xoi Lac TV crackdown; locked-ioc-33 sample volume surges (7,610 samples) in the aftermath.
• 2026-05-01 Pre-World Cup spike: 12% of Sable Squirrel's dropcatch domain acquisitions concentrate ahead of the 2026 FIFA World Cup.
• 2026-06-14 Operation Endgame disrupts locked-ioc-29 infrastructure, seizing over 300 servers and 140 domains.
• 2026-06-27 Shady Squirrel registers locked-ioc-7 to rebuild locked-ioc-29 delivery capability roughly ten days after Operation Endgame.
• 2026-07-10 A live fake browser-update payload confirms Shady Squirrel's restored locked-ioc-29 delivery chain is operational.
• 2026-08-14 Infoblox publishes multi-part threat intelligence research documenting Sable, Stuffy, Shady and Swiping Squirrel dropcatch campaigns.
• 2026-08-15 Security Affairs and other outlets report on the Infoblox dropcatch domain research, surfacing it for SOC detection coverage.

Sources cited for Squirrel streaming RAT cluster

• Illegal Streaming Fronts a $7M Dropcatch Domain Operation infoblox.com · Research · 2026-08-14
• Expired Malicious Domains Bring New Threats to Life infoblox.com · Research · 2026-08-14
• The Second Life of Expired Domains infoblox.com · Research · 2026-08-14
• Crooks are buying your expired domains and using them to deliver malware securityaffairs.com · News · 2026-08-15
• Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware The Hacker News · News · 2026-08-14
• Infoblox research finds 65,000 expired domains re-registered daily in first half of 2026 technode.global · News · 2026-08-14
• Cybercriminals invest millions in expired domains for illicit activities scworld.com · News · 2026-08-14
• Expired domains are a goldmine for hackers itpro.com · News · 2026-08-14

Threats related to Squirrel streaming RAT cluster

• Expired-Domain Resale Abuse Fuels Malware Delivery: Sable Squirrel and Scavenger Threat Clusters (Quasar RAT, AsyncRAT, DCRat, Remcos RAT, SocGholish)
• Malware Distribution Platform Exposed via Unsecured /install/install.php Setup Page (micronsoftwares[.]com / wetransfer[.]ICU SEO-Poisoning Operation)
• Fake Corepack.org Site Distributes OpenShield Infostealer/Proxyware to Developers; Secondary Malvertising Chain Delivers OperaGXSetup.exe Adware

Previous and next in malware

• DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling Previous report
• AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control Next report