Sable Squirrel Spent Nearly $7M on Expired Domains to Redirect Users to Gambling Sites and Malware

A Vietnam-linked threat actor tracked as Sable Squirrel has spent nearly $7 million buying up more than 10,000 expired "dropcatch" domains through registrars like GoDaddy, Namecheap, and DropCatch.com, according to Infoblox research reported by The Hacker News. Because these domains previously belonged to legitimate sites, they inherit real search rankings, backlinks, and user trust — 24% of the acquired domains go live with new content the same day, 76% within a week. The group, which overlaps with a Vietnamese illegal-streaming network dismantled by authorities in March 2026, uses cloaking chains to quietly redirect visitors looking for sports streams into gambling platforms (VSBet, ColaScore, 8xbet) while the same infrastructure doubles as command-and-control for malware including Quasar RAT, AsyncRAT, DCRat, and ransomware — researchers linked roughly 31,000 malware samples to this domain network, with victims spanning education, IT, government, healthcare, and banking sectors across Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia.

This is exactly the blind spot PurpleTrain's Spotting Fake Websites module trains people to catch. The module teaches learners to notice when a link doesn't lead where it claims to — an unexpected redirect, a mismatched brand after a page load, a domain that "feels" familiar but has quietly changed hands — rather than trusting a site just because it looks established or ranks well in search. Sable Squirrel's entire scheme depends on victims not questioning a redirect chain that starts on what looks like a normal streaming page; a workforce trained to pause and verify at that exact moment is the difference between watching a sports stream and having a RAT dropped on their machine.