Illegal Streaming Fronts a $7M Dropcatch Domain Operation

Sable Squirrel operates a massive criminal enterprise controlling over 10,000 domains, spending an estimated $7 million acquiring expired domains to inherit their reputation and traffic. The actor runs illegal Asian sports streaming services under brands like Xoilac, Cakhia, and 90phut, which funnel viewers to gambling platforms including VSBet and 8xbet. Analysis reveals over 31,000 malware samples connecting to Sable Squirrel infrastructure, including Quasar RAT, AsyncRAT, DCRat, and ransomware variants, with the same domains simultaneously hosting streaming content and serving as command-and-control servers. Despite Vietnamese law enforcement actions in early 2026, including arrests and asset seizures, the operation quickly recovered and expanded for the World Cup, demonstrating resilience through domain rotation and shared technical infrastructure spanning multiple Asian markets.

• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Grand Theft Auto VI hype leads to malwareMalware2026-09-09
• Still Circling: Toolkit Keeps EvolvingMalware2026-07-18
• Millenium: A RAT Rewritten, A Threat MultipliedMalware2026-06-25
• Investigating Abuse of Remote Desktop and Bulk Mailing AppsMalware2026-10-29