# Squirrel Threat Cluster Weaponizes Dropcatch/Expired Domains for RAT C2, SocGholish and Streaming-Gambling Fraud

> Infoblox tracks four financially-motivated 'Squirrel' actors (Sable, Stuffy, Shady, Swiping) that systematically re-register expired domains to inherit their reputation, backlinks and DNS history. Sable Squirrel alone spent ~$7M acquiring 10,000+ domains that now serve dual duty as illegal Vietnamese sports-streaming/gambling fronts and C2 for Quasar RAT, AsyncRAT, DCRat and Remcos RAT, while Shady Squirrel scavenged 700+ former TA2726/other domains to revive SocGholish delivery weeks after Operation Endgame's takedown.

- **Published:** 2026-08-15T00:00:00Z
- **Last reviewed:** 2026-08-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2022
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-squirrel-streaming-rat-cluster-tl-2026-2022.webp?v=26243cbb (Threadlinqs threat intel: Squirrel Streaming & RAT C2 Infrastructure: Detection & IOCs (TL-2026-2022) — High severity, 33 IOCs, 9 detection rules.)
- **ID:** TL-2026-2022
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Sable Squirrel
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)

## Description

Infoblox Threat Intel's multi-part 'dropcatch' research (published 2026-08-14, covered by Security Affairs on 2026-08-15) documents 65,000 expired domains being re-registered daily across gTLDs and ccTLDs in H1 2026 (~19-20% of all new registrations), concentrated in 15 TLDs. These 'dropcatch' domains retain residual web traffic, backlinks, cached search rankings, email forwarding and lingering DNS/CNAME records from their prior owners, giving buyers instant, laundered trust that new domains lack. Once re-registered, 24% of dropcatch domains are weaponized the same day, 76% within 7 days, and 94% within two weeks.

Four distinct but related actor clusters exploit this pattern. Sable Squirrel (active since at least June 2023, epicenter Vietnam, overlapping the dismantled Xoi Lac TV pirate-streaming network) has spent over $7M on 10,000+ domains -- including aged, high-trust corporate domains such as healthymagination[.]com (GE), krogeralbertsons[.]com, maxfactor-international[.]com (P&G), snsystems[.]com (former Sony PlayStation dev tools) and rezilion[.]com (cybersecurity firm later acquired by GitLab) -- and runs them as illegal sports-streaming brands (Xoilac, Cakhia, 90phut, Socolive, MiTom, ColaTV), online-gambling platforms (VSBet, ColaScore, 8xbet, 6686), and, since November 2025, RAT command-and-control: 405 C2-configured domains and 31,000+ malware samples communicating with them, delivering AsyncRAT 0.5.8, Quasar RAT, DCRat, NanoCore, Remcos RAT, njRAT and non-executing HiddenTear signatures. Malware samples embed the operator's own streaming/gambling brand names in binary metadata (CompanyName 'socoLIVE', ProductName 'xoilac', LegalTrademarks '8xbet') and Windows Run-key persistence, directly linking the malware to the streaming/gambling infrastructure. Roughly 12% of Infoblox's enterprise customers queried Sable Squirrel C2 domains, concentrated in education, IT/consulting, government, healthcare and banking.

Stuffy Squirrel (active since 2020, 500+ domains), Shady Squirrel (Russian-speaking, active since July 2023, 700+ domains) and Swiping Squirrel (active since 2022, 3,000+ domains) instead scavenge domains previously compromised by other intrusion actors (TA2726, Magecart, Balada Injector) and simply inherit the residual infected-site traffic rather than compromising sites themselves. All three run multi-layer cloaking (URL-path matching, server-side TDS filtering, referrer checks, user-interaction gating) so automated scanners see benign content while real visitors are redirected through Keitaro TDS instances into tech-support scams, SocGholish fake-browser-update malware, and zero-click ad-fraud platforms (ZeroPark, PushHouse, ExoClick). Shady Squirrel notably re-enabled SocGholish delivery via a newly registered domain (advanceslibrary[.]com, registered 2026-06-27) roughly ten days after the June 2026 Operation Endgame takedown seized 300+ SocGholish servers and 140 domains, restoring a live fake-update payload by 2026-07-10. Shady Squirrel separately ran an April-July 2026 tech-support-scam operation abusing 10,000+ Microsoft Azure static-web-hosting accounts monthly to display fake Microsoft security warnings with call-center phone numbers targeting Japan and the U.S.

Infoblox's underlying finding: security tooling that grants trust based on domain age, aged backlinks or historical reputation is systematically exploitable by this dropcatch pattern, and orphaned/dangling DNS CNAME records left behind by decommissioned services are a related, compounding hijacking vector (roughly a third of identified dangling CNAMEs were trivially takeable).

## MITRE ATT&CK

- T1596.001 Search Open Technical Databases: DNS/Passive DNS
- T1583.001 Acquire Infrastructure: Domains
- T1584.001 Compromise Infrastructure: Domains
- T1608.001 Stage Capabilities: Upload Malware
- T1608.004 Stage Capabilities: Drive-by Target
- T1583.006 Acquire Infrastructure: Web Services
- T1684.001 Impersonation
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1071.001 Application Layer Protocol: Web Protocols
- T1219 Remote Access Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery** (`TL-2026-2022-SPL-001`)

Detects HTTP/HTTPS requests from internal hosts to known Sable/Shady/Stuffy Squirrel dropcatch domains (aged, high-trust corporate/brand domains re-registered to inherit residual reputation) combined with fake browser-update lure patterns in the URI path, consistent with SocGholish drive-by delivery restored ~10 days after the June 2026 Operation Endgame takedown, and Sable Squirrel streaming/gambling front redirection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1608.004, T1204.002, T1656, T1583.001
- **Data sources:** proxy, web_proxy, dns
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="proxy:access"
(dest_domain IN ("cel-robox.com","xemlaibongda.net","xoilacxys.top","healthymagination.com","krogeralbertsons.com","rezilion.com","maxfactor-international.com","snsystems.com","veinteractive.com","advanceslibrary.com","blacksaltys.com","cdnjslibraries.com","simplejscdn.com","gsstats.ru","weatherplllatform.com","magesource.su","tofuturepubs.com"))
| eval fake_update_lure=if(match(uri_path, "(?i)(update|updater|out[-_]?of[-_]?date|browser[-_]?update|flash[-_]?player)"), 1, 0)
| stats count as hits, values(uri_path) as paths, values(http_user_agent) as user_agents, earliest(_time) as first_seen, latest(_time) as last_seen by src_ip, user, dest_domain, fake_update_lure
| where hits > 0
| sort - hits
```

### Microsoft KQL

```kql
let SquirrelDropcatchDomains = dynamic(["cel-robox.com","xemlaibongda.net","xoilacxys.top","healthymagination.com","krogeralbertsons.com","rezilion.com","maxfactor-international.com","snsystems.com","veinteractive.com","advanceslibrary.com","blacksaltys.com","cdnjslibraries.com","simplejscdn.com","gsstats.ru","weatherplllatform.com","magesource.su","tofuturepubs.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (SquirrelDropcatchDomains)
| extend FakeUpdateLure = RemoteUrl matches regex @"(?i)(update|updater|out-of-date|browser-update|flash-player)"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, FakeUpdateLure, InitiatingProcessFileName
| summarize Hits=count(), Paths=make_set(RemoteUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountName, RemoteIP
| order by Hits desc
```

### Sigma

```yaml
title: Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery
id: 7c3f2a10-9d41-4e5a-9c2b-11e8f4a2b001
status: experimental
description: Detects web requests to known Sable/Shady/Stuffy Squirrel dropcatch domains reviving aged corporate/brand reputations to deliver SocGholish-style fake browser-update lures and drive-by malware.
references:
    - https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/
    - https://securityaffairs.com/197251/uncategorized/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-15
tags:
    - attack.reconnaissance
    - attack.t1596.001
    - attack.resource-development
    - attack.t1583.001
    - attack.initial-access
    - attack.t1656
    - attack.execution
    - attack.t1204.002
    - attack.t1608.004
    - malware.socgholish
logsource:
    category: proxy
    product: generic
detection:
    selection_domain:
        c-uri-host|contains:
            - 'cel-robox.com'
            - 'xemlaibongda.net'
            - 'xoilacxys.top'
            - 'healthymagination.com'
            - 'krogeralbertsons.com'
            - 'rezilion.com'
            - 'maxfactor-international.com'
            - 'snsystems.com'
            - 'veinteractive.com'
            - 'advanceslibrary.com'
            - 'blacksaltys.com'
            - 'cdnjslibraries.com'
            - 'simplejscdn.com'
            - 'gsstats.ru'
            - 'weatherplllatform.com'
            - 'magesource.su'
            - 'tofuturepubs.com'
    selection_lure:
        cs-uri-stem|contains:
            - 'update'
            - 'browser-update'
            - 'out-of-date'
            - 'flash-player'
    condition: selection_domain or selection_lure
falsepositives:
    - Legitimate software update pages that coincidentally share URI keywords (rare given the domain allowlist restricts most false positives)
level: high

```

**Known false positives:**

- Legitimate corporate domains that share naming patterns with the dropcatch list before being confirmed re-registered (verify WHOIS/registrant change date)
- Internal QA/monitoring tools that legitimately crawl or health-check the listed domains

**Tuning notes:** Refresh the dropcatch domain allowlist against threat_iocs/osint_context on a rolling basis (Sable Squirrel weaponizes 76% of acquisitions within 7 days); narrow the fake_update_lure regex per environment to cut noise from legitimate software-update portals.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery (locked: unlock with TL Creds)
- Multi-RAT Registry Run-Key Persistence with Squirrel-Cluster Brand Metadata (locked: unlock with TL Creds)
- RAT C2 Beaconing to Squirrel Dropcatch and Community-Corroborated Sibling Infrastructure (locked: unlock with TL Creds)
- Dropcatch Domain Drive-By SocGholish Fake Browser-Update Delivery (locked: unlock with TL Creds)
- Multi-RAT Registry Run-Key Persistence with Squirrel-Cluster Brand Metadata (locked: unlock with TL Creds)
- RAT C2 Beaconing to Squirrel Dropcatch and Community-Corroborated Sibling Infrastructure (locked: unlock with TL Creds)
- Multi-RAT Registry Run-Key Persistence with Squirrel-Cluster Brand Metadata (locked: unlock with TL Creds)
- RAT C2 Beaconing to Squirrel Dropcatch and Community-Corroborated Sibling Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- Domain: `cel-robox[.]com`
- File hash: `0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216`
- Domain: `colatv88xb[.]cc`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Crooks are buying your expired domains and using them to deliver malware](https://securityaffairs.com/197251/uncategorized/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html)
- [Illegal Streaming Fronts a $7M Dropcatch Domain Operation](https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/)
- [Expired Malicious Domains Bring New Threats to Life](https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/)
- [The Second Life of Expired Domains](https://www.infoblox.com/blog/threat-intelligence/drop-something-dont-worry-someone-caught-it/)
- [Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware](https://thehackernews.com/2026/08/hackers-spend-nearly-7-million-on.html)
- [Infoblox research finds 65,000 expired domains re-registered daily in first half of 2026](https://technode.global/2026/08/14/infoblox-research-65000-expired-domains-reregistered-daily-h1-2026/)
- [Cybercriminals invest millions in expired domains for illicit activities](https://www.scworld.com/brief/cybercriminals-invest-millions-in-expired-domains-for-illicit-activities)
- [Expired domains are a goldmine for hackers](https://www.itpro.com/security/cyber-crime/expired-domains-are-a-goldmine-for-hackers-and-some-cyber-crime-groups-are-investing-millions-in-dropcatch-scams-to-deliver-malware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2022