China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites
Infoblox found China-aligned actors hiding PeckBirdy malware C2 inside fake Chinese-language casino and adult websites, evading security scans via service workers and WebSockets.
Infoblox reported that China-aligned actors behind the PeckBirdy JScript C2 framework conceal command-and-control inside low-quality Chinese-language casino and adult websites, extending Trend Micro's earlier findings that tied the framework to backdoors including MKDOOR and HOLODONUT. One decoy, vip311[.]cc, embedded JavaScript linked to cache-mcp[.]com and registered a service worker connecting to mcp-source[.]online over WebSocket; at publication mcp-source[.]online had zero VirusTotal detections, showing how the layered design evades conventional scanning. The campaign has been active since at least 2023, and just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with education, IT, banking and government among observed sectors.
- PeckBirdy is a JScript-based C2 framework delivering modular backdoors including MKDOOR and HOLODONUT against Asian government and gambling targets.
- Decoy sites register service workers and use WebSocket links, which conventional web scanners and reputation systems may miss.
- Active since at least 2023; just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain.
- Education, IT, banking and government organizations appeared among targets; 3-10 distinct C2 lookups warrant incident-response investigation.
- Roughly 1.7 million illegal Chinese-language gambling domains create camouflage that makes APT C2 look like consumer fraud.
- Vendors
- InfobloxTrend Micro
- Products
- PeckBirdy
- Threat actors
- China-aligned threat actors
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 11170011.com | ity casino websites in this network. A recently active site 11170011[.]com featuring “Venetian Macao” branding, translated into Engl |
| domain | 80074.cc | Language Casino Domains (Type 1) 11170011[.]com puqxr[.]com 80074[.]cc PeckBirdy C2 and Decoy Domains (Type 3) vip311[.]cc Decoy |
| domain | appcasino.online | Scambling Domains (Type 2) dollycasino[.]com dragobet[.]net appcasino[.]online Illegal Chinese-Language Casino Domains (Type 1) 11170011 |
| domain | cache-cdn.org | ly three. A previously identified PeckBirdy-related domain, cache-cdn[.]org, had 13 detections illustrating how visibility drops as o |
| domain | cache-mcp.com | embedded JavaScript associated with the PeckBirdy C2 domain cache-mcp[.]com. The script registered a service worker and connected to |
| domain | dollycasino.com | l pattern. IOCs Category Domains Scambling Domains (Type 2) dollycasino[.]com dragobet[.]net appcasino[.]online Illegal Chinese-Languag |
| domain | dragobet.net | y and unworthy of investigation. If you search this domain “dragobet[.]net” on Google it quickly becomes clear that someone ran a bl |
| domain | githubassets.net | is not automatically evidence of compromise. In particular, githubassets[.]net a PeckBirdy-associated typosquat can be reached through c |
| domain | mcp-source.online | ervice worker and connected to another infrastructure node, mcp-source[.]online, through WebSocket communications. That layered design ma |
| domain | puqxr.com | gal Chinese-Language Casino Domains (Type 1) 11170011[.]com puqxr[.]com 80074[.]cc PeckBirdy C2 and Decoy Domains (Type 3) vip311 |
| domain | vip311.cc | the threat actors have refined the camouflage. One example, vip311[.]cc, presented itself as a Chinese-language KY-branded casino |
From the original article
4 min read at gbhackers.com
China-aligned threat actors are concealing the PeckBirdy command-and-control framework inside low-quality Chinese-language casino and adult websites. Exploiting a vast and routinely ignored category of internet infrastructure to blend malware traffic into apparent gambling activity.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.