Indicators of compromise · AsyncRAT +1 — 8 shown
91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561c40317bafe39ec13bd944009bd6c53e6db8430c488433fdace6a3527b26588bb07fe77bfc9a7471d905aa46794dea97ecde0f3b1c167fce78eb79700245d0010102[.]220[.]161[.]94:80104[.]243[.]242[.]50:2301128[.]90[.]108[.]73:240545[.]74[.]19[.]54:1818128[.]90[.]108[.]35:2424
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
- Source: Infoblox
- Date: 2026-08-14
- Reliability: Tier 1/4 — Official / first-party (vendor technical analysis)
- Entity: "Sable Squirrel" operation, based in Vietnam
Summary
DNS intelligence firm Infoblox disclosed an operation it calls Sable Squirrel, based in Vietnam, which has spent nearly US$7 million acquiring expired ("dropcatch") domains to inherit their registration history, backlinks, residual traffic and reputation for criminal purposes. The infrastructure underlies a large Asian sports-piracy network and online gambling promotion while simultaneously operating as malware command-and-control.
Key Facts
- ~US$7M spent on expired domains to weaponise inherited trust signals
- Underlies sports-piracy brands: Xoilac, Cakhia, 90phut, Socolive, MiTom
- Promotes gambling brands: VSBet, ColaScore, 8xbet
- Functions as malware C2 for 31,000+ samples: Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT, HiddenTear-signature artifacts
- Traffic-distribution system redirects users in Vietnam, S. Korea, Japan, Taiwan, Singapore and Australia
- Android betting apps distributed via compromised Google Play developer accounts
- Operator hoards 10,000+ domains; 94% weaponised within two weeks of acquisition
- Confidence: Confirmed (vendor three-part technical analysis)
Impact
High relevance for Australian regulators and platform-enforcement teams: direct consumer-fraud exposure, abused distributed-trust channels, and blurred content-piracy/malware infrastructure.
Related Pages
- German Banking Hack Arrests — related fraud/financial-crime context
Sources: Infoblox; raw/digests/Cyber-Digest-2026-08-16.md