Prolific Puma

Prolific Puma is a DNS threat actor and cybercrime enabler that operates an underground link-shortening service used by multiple malicious actors. Infoblox reported the actor has operated for at least four years and uses a registered domain generation algorithm (RDGA) to create large volumes of pseudo-random, short-lived domains, with reporting citing roughly 35,000 to 75,000 unique domains since April 2022. The actor primarily registers domains through NameSilo and heavily abuses the .us top-level domain, including use of fake registration data and strategic domain aging to evade detection. Infoblox correlated large numbers of Prolific Puma domains through WHOIS domain owner records, aided by the .us TLD’s prohibition on WHOIS proxy services. According to the provided content, Prolific Puma’s infrastructure supports phishing, scams, and browser-based malware delivery, and shortened links are distributed via SMS, social media, and advertisements. The actor uses bulletproof hosting providers, dedicated VPS infrastructure, and Bitcoin for domains and hosting. Their domains are typically short, alphanumeric, and pseudo-random, and are often parked for weeks before use to build reputation and avoid newly registered domain blocking. The content describes Prolific Puma as an indirect but significant infrastructure provider in the broader cybercrime ecosystem. Trend Micro reported that a URL hosting Play ransomware payloads and tools was linked to Prolific Puma, and separate reporting cited shared IP addresses and tools such as PsExec, NetScan, and the Coroxy backdoor as evidence that the Play ransomware group appears to utilize Prolific Puma infrastructure. The content also mentions Prolific Puma alongside Revolver Rabbit and VexTrio Viper as actors using similar techniques. No high-confidence attribution to a nation state is provided in the content.