Sable Squirrel is an Asian threat actor that has spent an estimated $7 million acquiring expired domains with legitimate histories to build a vertically integrated criminal operation spanning illegal sports streaming, online gambling, and malware C2. Over 31,000 malware samples across multiple RAT families and HiddenTear ransomware connect to Sable Squirrel domains, with a coordinated wave in late 2025 converting roughly 350 existing streaming domains into dual-use C2 infrastructure. The operation shares brands, infrastructure, and PE metadata across streaming, gambling, and malware components, indicating a single operator rather than loosely affiliated campaigns.
RAT C2
1 post
$7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret