Cybercriminals Exploit Expired Domains for Malware and Scams

• •Cybercriminals are re-registering 65,000 expired domains daily for malicious use.
• •Sable Squirrel spent over $7 million on expired domains for illegal activities.
• •Repurposed domains pose a greater risk than newly registered domains due to retained trust.

Cybercriminals are investing millions in expired domain names to facilitate various illicit activities, including malware distribution and scams. A report by Infoblox Threat Intel reveals that approximately 65,000 expired domains are re-registered daily, making them attractive to attackers due to their retained trust and traffic. Notable actors like Sable Squirrel have spent over $7 million on these domains for illegal streaming and malware command and control. The domains often host seemingly legitimate sites while serving as channels for malware such as Quasar RAT and HiddenTear ransomware. Another group, Shady Squirrel, is linked to the SocGholish infrastructure, delivering malware through scareware tactics. The repurposing of these domains poses a significant risk, potentially greater than newly registered domains.