$7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret

Scenario A

Infoblox is tracking a threat actor they call Sable Squirrel, which has spent over $7M acquiring expired domains to build a sprawling infrastructure for illegal streaming, gambling, RAT delivery, and ransomware distribution. This isn't a single campaign—it's a persistent, multi-year operation leveraging domain reputation to bypass initial security filters.

Technical Breakdown

• TTPs: The core technique is domain squatting via expired registrations (T1583.001). The actor buys aged domains with existing traffic and reputation, then repurposes them for malicious payload hosting or redirect chains.
• Payloads: Observed delivery of remote access trojans (RATs), ransomware loaders, and illegal streaming/gambling landing pages.
• Infrastructure: Domains previously tied to legitimate news sites, failed startups, corporate campaigns, and even a football club website—all now weaponized.
• Scale: $7M in domain acquisition costs suggests hundreds (if not thousands) of domains in rotation, making blocklist-based defense insufficient.

Defense

Focus on domain age + reputation scoring at the DNS layer, not just static blocklists. Monitor for sudden changes in DNS resolution patterns on aged domains. Treat any expired domain that suddenly starts resolving to new infrastructure as a high-risk indicator.

Source: https://www.infoblox.com/blog/threat-intelligence/7-million-in-expired-domains-fuel-a-streaming-empire-with-a-malware-secret/