The threat actor known as Sable Squirrel manages a vast criminal enterprise leveraging over 10,000 domains acquired via dropcatching expired domains to inherit their reputation and traffic. These domains host illegal Asian sports streaming services under brands such as Xoilac, Cakhia, and 90phut, which funnel users to gambling platforms like VSBet and 8xbet. Analysis identified over 31,000 malware samples connecting to Sable Squirrel infrastructure, including remote access trojans (Quasar RAT, AsyncRAT, DCRat) and ransomware variants. Notably, the same domains simultaneously serve streaming content and act as command-and-control servers for malware operations. Vietnamese law enforcement disrupted the operation in early 2026 with arrests and asset seizures, but the group rapidly recovered and expanded for the World Cup period by employing domain rotation and shared technical infrastructure across multiple Asian countries.

The operation facilitates illegal streaming and gambling activities while simultaneously supporting a large-scale malware distribution infrastructure. The dual use of domains for both streaming and command-and-control increases the complexity of detection and takedown efforts. The presence of multiple malware families, including RATs and ransomware, indicates a broad and persistent threat to affected users and networks. The resilience and rapid recovery after law enforcement intervention suggest ongoing risk to the Asian market and potentially beyond.

No official patch or fix applies as this is a criminal infrastructure operation rather than a software vulnerability. Mitigation focuses on monitoring and blocking known malicious domains and hashes associated with Sable Squirrel, as well as coordinating with law enforcement for takedown efforts. Organizations should update threat intelligence feeds with the provided indicators of compromise to detect and prevent connections to this infrastructure. Due to the operation's use of domain rotation and shared infrastructure, continuous monitoring and rapid response to new indicators are recommended.