Infoblox Threat Intel

Sable Squirrel is a transnational threat actor operating a sports-streaming, gambling, and malware network across more than 10,000 domains. The actor combines disposable lookalike registrations with dropcatch domains acquired for their residual traffic and reputation. It promotes its streaming brands through compromised websites and hijacked developer accounts. Sable Squirrel’s estimated $7 million domain acquisition budget is the largest Infoblox has attributed to a single group. Its acquisitions include domains formerly owned by U.S. government agencies, Fortune 100 companies, and major charities. Infoblox tracks the actor through distinctive DNS signatures and file artifacts.

• Operating since: May 2016
• Infoblox discovered: January 2026
• Infoblox published: August 2026
• Prevalence: Common