Loading threat actor…
Sable Squirrel is a financially motivated cybercriminal actor associated with Vietnam and centered on large-scale abuse of expired re-registered domains. The actor is assessed to control more than 10,000 domains and to have spent roughly $7 million acquiring dropped domains in order to inherit residual trust, backlinks, traffic, and other historical reputation signals. Its infrastructure supports a blended criminal enterprise spanning illegal sports streaming, online gambling promotion, traffic redirection, mobile app distribution, and malware command-and-control. The actor is closely associated with Asian sports-piracy brands including Xoilac, Cakhia, 90phut, Socolive, and MiTom, and with betting promotion brands such as VSBet, ColaScore, 8xbet, and 6686. Sable Squirrel uses a two-track domain strategy: acquiring expired domains through dropcatch and auction processes while also registering fresh lookalike domains tied to its streaming brands. It has used traffic distribution to redirect selected users in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia to illicit streaming and betting content. Evidence also indicates overlap with the Xoi Lac TV illegal streaming network disrupted by Vietnamese authorities in 2026. Sable Squirrel infrastructure has also been used for malware operations at significant scale. More than 31,000 malware samples have been observed communicating with domains linked to the actor, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, njRAT, and samples carrying HiddenTear ransomware signatures. A subset of the actor’s streaming domains simultaneously served consumer-facing live sports content and functioned as malware command-and-control servers, demonstrating deliberate dual-use infrastructure. Observed malware weaponization accelerated in late 2025, with AsyncRAT appearing first and DCRat later becoming a primary payload. The actor’s operational behavior shows rapid activation of newly acquired domains, broad infrastructure management, and monetization through gambling and related criminal services rather than conventional espionage. Observed victim network exposure to its malware command-and-control infrastructure has included organizations in education, information technology and consulting, government, healthcare, and banking. Known aliasing in the available reporting is limited to Sable Squirrel; related but distinct actor clusters include Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
39 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Acquires large volumes of expired domains to exploit inherited reputation, traffic, and DNS history for criminal operations including illegal sports streaming, gambling promotion, and malware command-and-control infrastructure.
Uses expired 'dropcatch' domains at scale to support a criminal ecosystem involving illegal sports streaming, gambling promotion, and malware command-and-control infrastructure.
Uses large volumes of expired 'dropcatch' domains for illegal streaming infrastructure and malware command-and-control operations.
Operates a large expired-domain acquisition scheme to inherit trust, traffic, and backlinks, using the domains for illegal sports streaming, gambling promotion, traffic redirection, and malware command-and-control infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.