$7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret

Infoblox details “Sable Squirrel,” a transnational cybercriminal operator that has spent millions on expired domains to build a >10,000-domain infrastructure used for Vietnamese-focused illegal sports streaming and associated gambling platforms, while concurrently configuring hundreds of those same domains as malware C2 (over 31,000 samples observed across multiple RAT families and some HiddenTear signatures); the operation is vertically integrated, resilient to takedowns, and exposes networks across many industries.