# Expired-Domain Resale Abuse Fuels Malware Delivery: Sable Squirrel and Scavenger Threat Clusters (Quasar RAT, AsyncRAT, DCRat, Remcos RAT, SocGholish)

> Infoblox Threat Intel documents four affiliated dropcatch-domain actors — Sable Squirrel (10,000+ domains, ~$7M spent) and the Scavenger cluster (Stuffy Squirrel, Shady Squirrel, Swiping Squirrel) — that systematically buy or backorder expired domains to inherit residual reputation, traffic, and DNS history for illegal-streaming malware delivery, SocGholish fake-update campaigns, and tech-support scams. Sable Squirrel's Xoilac/Cakhia/90phut/Socolive/MiTom streaming platforms double as C2 for Quasar RAT, AsyncRAT, DCRat, and Remcos RAT across Vietnam, South Korea, Japan, and Australia, while Shady Squirrel resupplied SocGholish with victim traffic within 10 days of Operation Endgame's June 2026 takedown.

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2033
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sable-squirrel-dropcatch-campaign-tl-2026-2033.webp?v=3af9dc6d (Threadlinqs threat intel: Sable Squirrel Dropcatch Malware Campaign: Detection & IOCs (TL-2026-2033) — Medium severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2033
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Sable Squirrel
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

Infoblox Threat Intel's three-part "Dropcatch Domains" research series (published 2026-08-13, syndicated by SecurityAffairs, The Hacker News, IT Pro, and SC Media on 2026-08-14/15) documents an industrial-scale abuse of expired-domain re-registration ("dropcatching"): roughly 65,000 expired domains are re-registered daily in H1 2026 — nearly 20% of all newly observed domains — because expired domains retain backlinks, search-engine trust, cached traffic, and DNS history that criminals can immediately weaponize instead of building reputation from scratch.

The report attributes the largest single dropcatch operation to Sable Squirrel, a well-funded, likely transnational actor with a Vietnamese operational focus. Sable Squirrel controls more than 10,000 domains and has an extrapolated spend exceeding $7 million (confirmed: 160+ purchases, $430K+ documented) through GoDaddy, DropCatch.com, Namecheap, and Dynadot. Median domain activation is 5 days post-purchase, with 24% live same-day, 76% within a week, and 94% within two weeks. Premium acquisitions included brand-name domains with residual trust (healthymagination[.]com — formerly a GE health initiative; krogeralbertsons[.]com — the Kroger-Albertsons merger domain; maxfactor-international[.]com; veinteractive[.]com), alongside disposable lookalike domains seeded from Vietnamese football/streaming terms (xoilac, cakhia, 90phut, socolive, mitom, vaoroi).

The resulting platforms — branded Xoilac, Cakhia, 90phut, Socolive, and MiTom (secondary: ColaTV, Vaoroi) — are WordPress-based illegal sports-streaming sites geo-targeting Vietnam, South Korea, Taiwan, Singapore, Japan, and Australia, monetized through gambling/betting redirects (VSBet, ColaScore, 8xbet, 6686) behind cloaking/traffic-distribution infrastructure (6789x[.]site and similar). A subset of the same streaming domains double as live command-and-control infrastructure: Infoblox counted 405 confirmed malware C2 domains overlapping with the streaming footprint (peak 386 simultaneously active in December 2025) and 31,000+ malware samples. The malware timeline runs from early Quasar RAT testing (October 2025), through the first C2 configurations appearing on streaming domains (November 2025), a mass-weaponization wave covering ~86% of C2 domains (December 2025), sustained AsyncRAT 0.5.8 deployment (November 2025-March 2026, mutex lM9F7Ezcu9e3), to a DCRat surge of 7,610 samples in March 2026 that coincided with a Vietnamese law-enforcement crackdown (Xoi Lac TV site freeze February 2026; 30 suspects charged and ~300 billion VND / ~$12M USD seized in March 2026). Malware samples are explicitly self-branded with Windows PE metadata matching the streaming platforms (CompanyName "socoLIVE", FileDescription "xoilac client", ProductName "xoilac", trademarks referencing "8xbet", a Windows startup persistence key named "xoilac"), and telemetry shows exposure across 24+ industries, led by education (~20% of C2 queries) and IT/consulting (~14%), with government, healthcare, and banking sectors also affected. The highest-impact single C2/streaming domain was colatv88xb[.]cc, accounting for roughly 70% of exposed-network DNS queries. Evidence links Sable Squirrel to a broader Asian streaming-gambling ecosystem: shared live-chat code with Chinese-language comments on Chinese sports-betting sites, a shared image-serving backend (TheSports[.]com) used across Vietnamese, Chinese, Indonesian, and Russian-language gambling platforms, and the AiScore mobile app (10M+ Google Play installs) distributed by Hong Kong/Singapore-registered entities. Two documented incidents show Sable Squirrel infrastructure itself getting hijacked by third parties: xemlaibongda[.]net (Balada Injector-infected WordPress redirecting to a Keitaro-tracked BroPush affiliate chain) and xoilacxys[.]top (registrar-account takeover redirecting to a Russian investment scam before going lame).

A separate but related "Scavenger" cluster of three actors — Stuffy Squirrel (500+ domains, active since 2020), Shady Squirrel (700+ domains, active since July 2023, assessed Russian-speaking), and Swiping Squirrel (3,000+ domains, active since 2022) — specialize in acquiring expired domains that were previously compromised by other threat actors (TA2726, Magecart, Balada Injector) and immediately inherit the pre-existing infection/injection traffic without needing to re-compromise the underlying site. Stuffy Squirrel's current primary domain (gsstats[.]ru, active since November 2025, formerly weatherplllatform[.]com under Balada) runs a two-checkpoint cloaking chain (URL-path decoy serving Raphaël.js, then a 1,225-character self-removing IIFE gated by an independent TDS click-check) monetized first via PushHouse/ExoClick (through January 2025) and then ExoClick plus a Russian popunder network (from March 2025). Shady Squirrel (blacksaltys[.]com — formerly TA2726 infrastructure; plus simplejscdn[.]com, cdnjslibraries[.]com, imhd[.]io, pausewatchings[.]com, pills-europe[.]com, wesq[.]me, advanceslibrary[.]com, brodirect3s[.]site) runs custom JS injections behind Keitaro TDS with referrer-gated payload delivery, downstream to 1Win Russian gambling, a Japan/US-targeted tech-support scam (April-July 2026: phone numbers +1-201-409-2894 Japan-only, +1-877-481-2126, +1-888-756-6605; ~10,000 Azure static-webhosting accounts created monthly across 9+ regions; a 1x1-pixel beacon geolocates victims by IP/user-agent to select the delivered phone number; payload sections are AES-encrypted and decrypted client-side using the URL fragment as the key), and — most notably — SocGholish. Within roughly 10 days of Operation Endgame's June 2026 disruption of SocGholish infrastructure (300+ servers, 140+ domains seized, €41M frozen), Shady Squirrel registered advanceslibrary[.]com (2026-06-27) and began serving confirmed SocGholish fake-browser-update lures by 2026-07-10 (the domain was independently leaked in a Facebook post); the actor went silent again in early July 2026. Keitaro injection chains across Stuffy and Shady Squirrel share consistent tracking cookies ("0c9c8", "208c9") also previously observed with TA2726, and the two-part Keitaro injection pattern (config-name parameter to a Keitaro server, then localStorage-based campaign/subid/token retrieval) traces to a documented technique first seen with Help TDS in September 2020. Swiping Squirrel (blackshelter[.]org, bluegaslamp[.]org, draggedline[.]org, getshopstar[.]com, jqueryapihelpers[.]com, lzdatheme[.]com, slurpslimes[.]org, webpixel[.]app, windowlight[.]org) runs a distinct multi-stage cloaking pipeline (client-side fingerprint script -> index.php cloaker returning {} or "fw" -> /s/index/ relay -> /f/index affiliate-bid endpoint -> meta-refresh) funneling traffic to ZeroPark (Team Internet), AliExpress, and Kelkoo affiliate offers, with ClickFix malware observed downstream via the AdventureFeeds affiliate chain from ZeroPark.

Collectively, the four clusters demonstrate that expired-domain resale is now an organized, well-capitalized initial-access and C2 vector operating in parallel with (and largely orthogonal to) traditional vulnerability exploitation: no CVE applies, the abused surface is domain-lifecycle policy at registrars/registries, and both operational-security weaknesses (reused registrant contact details, a bogus Ho Chi Minh City business address, self-branded malware) and law-enforcement pressure (Vietnamese 2026 crackdown, Operation Endgame) have so far only produced brief dips before the operations resumed and expanded, reportedly gearing up around the 2026 FIFA World Cup streaming demand.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1583.008 Malvertising
- T1587.001 Malware
- T1608.001 Upload Malware
- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1665 Hide Infrastructure
- T1082 System Information Discovery
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dropcatch Domain Resolution — Sable/Scavenger Squirrel Streaming & C2 Infrastructure** (`TL-2026-2033-SPL-001`)

Detects DNS resolution or proxy requests to expired-domain ("dropcatch") infrastructure re-registered by the Sable Squirrel and Scavenger cluster (Stuffy/Shady/Swiping Squirrel) actors, including the highest-impact C2/streaming node colatv88xb.cc (~70% of exposed-network DNS queries in Infoblox telemetry), the compromised/registrar-hijacked xoilacxys.top and xemlaibongda.net, and premium brand-trust acquisitions (healthymagination.com, krogeralbertsons.com) used to seed reputation for later weaponization.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1583.006, T1665
- **Data sources:** dns_logs, proxy_logs, infoblox_dns, device_network_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=dns sourcetype IN ("stream:dns","infoblox:dns","proxy:access")
| eval domain=coalesce(query, dest_host, url_domain)
| where match(domain, "(?i)(colatv88xb\.cc|xoilacxys\.top|xemlaibongda\.net|api-score\.com|6789x\.site|gsstats\.ru|weatherplllatform\.com|blacksaltys\.com|advanceslibrary\.com|pausewatchings\.com|blackshelter\.org|healthymagination\.com|krogeralbertsons\.com)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sourcetypes by src_ip, domain
| where count > 0
| sort -count
```

### Microsoft KQL

```kql
DnsEvents
| where TimeGenerated > ago(24h)
| where Name has_any ("colatv88xb.cc","xoilacxys.top","xemlaibongda.net","api-score.com","6789x.site","gsstats.ru","weatherplllatform.com","blacksaltys.com","advanceslibrary.com","pausewatchings.com","blackshelter.org","healthymagination.com","krogeralbertsons.com")
| project TimeGenerated, Computer, ClientIP, Name, QueryType
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("colatv88xb.cc","xoilacxys.top","xemlaibongda.net","api-score.com","6789x.site","gsstats.ru","weatherplllatform.com","blacksaltys.com","advanceslibrary.com","pausewatchings.com","blackshelter.org")
    | project TimeGenerated=Timestamp, Computer=DeviceName, ClientIP=LocalIP, Name=RemoteUrl, QueryType="http"
)
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: DNS/HTTP Resolution to Sable or Scavenger Squirrel Dropcatch Domains
id: b7e4a1c2-3d5f-4a6b-8c9e-1f2a3b4c5d6e
status: experimental
description: Detects DNS or proxy activity toward expired domains re-registered (dropcatched) by the Sable Squirrel and Scavenger (Stuffy/Shady/Swiping Squirrel) clusters for illegal-streaming C2, SocGholish delivery, and gambling redirects.
references:
    - https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/
    - https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-16
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.t1583.006
    - attack.t1665
    - attack.tool.keitaro_tds
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        query|contains:
            - 'colatv88xb.cc'
            - 'xoilacxys.top'
            - 'xemlaibongda.net'
            - 'api-score.com'
            - '6789x.site'
            - 'gsstats.ru'
            - 'weatherplllatform.com'
            - 'blacksaltys.com'
            - 'advanceslibrary.com'
            - 'pausewatchings.com'
            - 'blackshelter.org'
            - 'healthymagination.com'
            - 'krogeralbertsons.com'
    condition: selection
falsepositives:
    - None expected under normal operation; these are confirmed malicious dropcatch domains, not shared/multi-tenant hosting
level: high
```

**Known false positives:**

- None expected for exact-match domains; if Infoblox or a takedown authority later sinkholes a listed domain, remove it from the watchlist to avoid alerting on benign sinkhole responses.

**Tuning notes:** Keep the domain list synchronized with Infoblox Threat Intel's ongoing dropcatch reporting; retire an entry once passive DNS shows it delegated to defunct/parked nameservers (as happened with xoilacxys.top), and add newly reported Sable/Scavenger acquisitions promptly given median 5-day activation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WordPress Plugin Exploitation Feeding Scavenger-Cluster Redirect Chain (Balada Injector / TA2726 / Magecart) (locked: unlock with TL Creds)
- AsyncRAT 0.5.8 Mutex (lM9F7Ezcu9e3) and Commodity-RAT Process Injection (locked: unlock with TL Creds)
- Dynamic-DNS RAT C2 Beaconing (DuckDNS / ydns.eu) — Community-Corroborated Sibling Infrastructure (locked: unlock with TL Creds)
- Fake Streaming-Client / SocGholish-Style Browser-Update Executable Launched from Browser (locked: unlock with TL Creds)
- PE Metadata Brand Masquerading Followed by Host-Discovery Commands (locked: unlock with TL Creds)
- Keitaro TDS Cloaking Chain to Gambling Redirect / Tech-Support-Scam Azure Static Web Hosting (locked: unlock with TL Creds)
- "[indicator]" Startup Persistence Registry Key — Sable Squirrel RAT Implant (locked: unlock with TL Creds)
- Sustained Outbound Beaconing to Sable Squirrel Streaming/C2 Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- Domain: `colatv88xb[.]cc`
- File hash: `0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216`
- Domain: `xoilacxys[.]top`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Crooks are buying your expired domains and using them to deliver malware](https://securityaffairs.com/197251/cyber-crime/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html)
- [Illegal Streaming Fronts a $7M Dropcatch Domain Operation](https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/)
- [Expired Malicious Domains Bring New Threats to Life](https://www.infoblox.com/blog/threat-intelligence/dropcatch-scavengers-expired-malicious-domains-become-cash-cows/)
- [Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware](https://thehackernews.com/2026/08/hackers-spend-nearly-7-million-on.html)
- [Infoblox research finds 65,000 expired domains re-registered daily in first half of 2026](https://technode.global/2026/08/14/infoblox-research-65000-expired-domains-reregistered-daily-h1-2026/)
- [Expired domains are a goldmine for hackers - and some cyber crime groups are investing millions in 'dropcatch' scams to deliver malware](https://www.itpro.com/security/cyber-crime/expired-domains-are-a-goldmine-for-hackers-and-some-cyber-crime-groups-are-investing-millions-in-dropcatch-scams-to-deliver-malware)
- [Cybercriminals invest millions in expired domains for illicit activities](https://www.scworld.com/brief/cybercriminals-invest-millions-in-expired-domains-for-illicit-activities)
- [Infoblox welcomes Operation Endgame action against SocGholish and urges organisations to remain vigilant](https://www.intelligentciso.com/2026/06/24/infoblox-welcomes-operation-endgame-action-against-socgholish-and-urges-organisations-to-remain-vigilant/)
- [Infoblox Threat Intel](https://www.infoblox.com/threat-intel/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2033