Sable Squirrel is a Vietnam-based threat actor that has spent nearly $7 million acquiring expired domains to build a criminal enterprise. It operates illegal sports streaming platforms and gambling promotions, while also using a subset of domains as malware C2 infrastructure. The group controls over 10,000 domains and has been active since at least June 2023.