Infoblox Threat Intel
Vacant Viper
Vacant Viper uses the “Sitting Ducks” DNS attack vector to hijack about 2,500 domains a year with lame name server delegation. The actor leverages the reputations of established domains to pass through security filters as benign entities. Vacant Viper appears to use free DNS hosting services, holding each hijacked domain for approximately 30 days at a time. This enables multiple actors to reuse valuable domain assets.
Hijacked domains are used for multiple purposes, most notably for routing in the 404TDS. This malicious TDS is known to deliver malware, including AsyncRAT and DarkGate, as well as scams.
Vacant Viper
- Operating since: At least 2019
- Infoblox discovered: Feb 2024
- Infoblox published: July 2025
- Prevalence: Uncommon
