Fast Facts
- Threat actors are repurposing millions of expired domains daily, leveraging their existing trust to facilitate malware distribution, scams, and illegal activities.
- These domains often host legitimate-looking services like streaming sites that also serve as command-and-control channels for malware such as Quasar RAT and ransomware.
- Large-scale operations, including groups like Sable Squirrel, invest millions to exploit these domains, significantly increasing the risk of sophisticated cyber threats and scams.
Threat, Attack Techniques, and Targets
Cybercriminals are spending millions of dollars to acquire expired domains. They use these domains for illegal activities like malware spreading, scams, illegal streaming, and online gambling. These domains are called “dropcatch” domains. They are attractive because they still have trust, backlinks, and web traffic from their previous legitimate life. Because of this, security systems see them as more trustworthy than new, unclaimed domains. Each day, about 65,000 such domains are registered. Threat actors often use these domains to host fake streaming sites or act as command and control channels for malware. One group, Sable Squirrel, spent over $7 million on more than 10,000 domains for malicious use. These domains can hide malware like Quasar RAT and HiddenTear ransomware. Another group, Shady Squirrel, works with fake update sites called SocGholish. They deliver malware through scareware and call centers.
Impact, Security Implications, and Remediation Guidance
The use of these expired domains poses big risks. Because they are trusted and seem legitimate, they can deceive users and bypass security tools. This makes it easier for malware to spread and for scammers to succeed. The widespread use of these domains increases the threat level significantly. Organizations should be aware of this issue and monitor for suspicious domains. If you notice any threats related to expired domains, get guidance from your security vendor or relevant authority. They can provide specific steps to block or remove these malicious domains and protect your systems.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
