Threat actors are increasingly acquiring expired domains—known as "dropcatch domains"—to inherit their reputation and traffic, redirecting victims to scams and malware. According…
Sable Squirrel is a Vietnam-based threat actor that has spent nearly $7 million acquiring expired domains to build a criminal enterprise. It…
NanoCore is a remote access trojan that has been identified in malware samples communicating with Sable Squirrel's infrastructure, highlighting its role in…
njRAT is a remote access trojan that has been detected in malware samples communicating with Sable Squirrel's infrastructure, contributing to the threat…
HiddenTear is a ransomware family whose signatures have been found in artifacts communicating with Sable Squirrel's infrastructure, indicating potential ransomware activity within…
Dynabot is a domain registrar that has been used by Sable Squirrel to purchase expired domains at auctions, contributing to the threat…
General Electric launched the health initiative healthymagination.com in 2009. The domain was later acquired by Sable Squirrel for illegal sports-streaming operations.
Procter & Gamble owned the cosmetics brand domain maxfactor-international.com, which was later acquired by Sable Squirrel for illegal streaming activities.
Kroger was involved in the proposed merger with Albertsons, which used the domain krogeralbertsons.com. The domain was later acquired by Sable Squirrel…
Albertsons was part of the proposed merger with Kroger, which used the domain krogeralbertsons.com. The domain was later acquired by Sable Squirrel…