A threat actor known asProlific Pumahas been maintaining a low profile and operating an underground link shortening service that’s offered to other threat actors for at least over the past four years. Prolific Puma creates “domain names with anRDGA[registered domain generation algorithm] and use these domains to provide a link shortening service to other malicious actors, helping them evade