Indicators of compromise · AsyncRAT +1 — 8 shown
91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561c40317bafe39ec13bd944009bd6c53e6db8430c488433fdace6a3527b26588bb07fe77bfc9a7471d905aa46794dea97ecde0f3b1c167fce78eb79700245d0010102[.]220[.]161[.]94:80104[.]243[.]242[.]50:2301128[.]90[.]108[.]73:240545[.]74[.]19[.]54:1818128[.]90[.]108[.]35:2424
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Hackers Spend ~$7M on Expired Domains to Redirect Traffic to Scams and Malware
Summary
DNS intelligence firm Infoblox detailed an operation it calls Sable Squirrel, based in Vietnam, that has spent nearly US$7 million acquiring expired ("dropcatch") domains so their inherited reputation, traffic and backlinks could be repurposed for illegal sports streaming, online gambling promotion and, in parallel, as malware command-and-control for 31,000+ samples.
Key Details
- Date: 2026-08-14
- Source: Infoblox
- Reliability: Tier 1/4 — Official / first-party (vendor technical analysis)
- Status: Confirmed (vendor three-part technical analysis with named infrastructure)
- Model: Inherit domain reputation/backlinks/traffic for criminal use
- Fronts: Asian sports-piracy brands (Xoilac, Cakhia, 90phut, Socolive, MiTom); gambling brands (VSBet, ColaScore, 8xbet)
- Malware C2: 31,000+ samples including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT; HiddenTear-signature artifacts
- Scale: 10,000+ domains hoarded; 94% weaponised within two weeks of acquisition
- Distribution: Traffic-distribution system targeting Vietnam, South Korea, Japan, Taiwan, Singapore and Australia; Android apps via compromised Google Play developer accounts
Significance
Sable Squirrel weaponises expired-domain reputation and trusted distribution channels (Google Play, social media) to funnel traffic to scams while masking malware C2 behind legal-looking streaming/gambling front-ends — an example of adversaries commoditising trust signals. Directly targets Australian users, making it relevant to ACSC and platform-enforcement teams.
Related
- Dysphoria Iot Botnet Integrates Blockchain C2 And Relays To Evade Law Enforcemen — Evasion-oriented infrastructure abuse
- Investigation Of German Banking Hack Leads To Arrests In Germany Brazil — Parallel criminal money/payment infrastructure