PeckBirdy C2 Traffic Seen Across Enterprise Networks While Hiding Behind Casino Domains
Infoblox and Trend Micro detail China-aligned actors hiding PeckBirdy JavaScript C2 behind Chinese casino domains, with over 3% of enterprise customers resolving malicious domains.
Infoblox telemetry found just over 3% of enterprise customers resolved at least one PeckBirdy C2 domain, including cache-mcp[.]com and mcp-source[.]online, indicating reach beyond the campaign's apparent Asian victim focus. Trend Micro links PeckBirdy, a JScript C2 framework active since 2023, to China-aligned campaigns targeting Chinese gambling organizations, Asian government entities, and private-sector organizations. Low-quality casino portals such as vip311[.]cc embed malicious JavaScript and WebSocket C2 endpoints that evade scanners, delivering tailored landing scripts for MSHTA, HTML, and WScript execution and abusing Windows LOLBins. Infoblox tracks roughly 1.7 million Chinese-language casino domains, with the FUNNULL CDN and Vigorish Viper clusters covering about 81% of that population.
- Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain
- Casino portals serve as cover for malicious JavaScript, WebSocket C2, and service-worker activity
- PeckBirdy delivers landing scripts for HTA, HTML, and WScript execution, abusing Windows LOLBins
- Key indicators include cache-mcp[.]com, mcp-source[.]online, and cache-cdn[.]org
- Defenders urged to classify casino domains by behavioral risk, not web-filter category
- Vendors
- InfobloxTrend Micro
- Threat actors
- PeckBirdy
- Malware
- PeckBirdy
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 11170011.com | ry Domains Illegal Chinese-Language Casino Domains (Type 1) 11170011[.]com puqxr[.]com 80074[.]cc Scambling Domains (Type 2) dollyca |
| domain | 80074.cc | Language Casino Domains (Type 1) 11170011[.]com puqxr[.]com 80074[.]cc Scambling Domains (Type 2) dollycasino[.]com dragobet[.]n |
| domain | appcasino.online | Scambling Domains (Type 2) dollycasino[.]com dragobet[.]net appcasino[.]online PeckBirdy C2 and Decoy Domains (Type 3) vip311[.]cc Decoy |
| domain | cache-cdn.org | ine, alongside previously documented infrastructure such as cache-cdn[.]org. Infoblox found that detection coverage declined sharply |
| domain | cache-mcp.com | casino branding while embedding the PeckBirdy-linked domain cache-mcp[.]com. Analysis of the malicious JavaScript then exposed an add |
| domain | dollycasino.com | 011[.]com puqxr[.]com 80074[.]cc Scambling Domains (Type 2) dollycasino[.]com dragobet[.]net appcasino[.]online PeckBirdy C2 and Decoy |
| domain | dragobet.net | ains or have broken experiences like the live site found at dragobet[.]net. Drago Bet Casino (dragobet[.]net) features numerous low- |
| domain | githubassets.net | irdy domains rather than overreacting to a single query for githubassets[.]net, a typosquat-like domain that can also result from develo |
| domain | mcp-source.online | pt then exposed an additional WebSocket-connected endpoint, mcp-source[.]online, which had zero VirusTotal detections at the time Infoblo |
| domain | puqxr.com | ling-themed templates. Screenshot of a recently active site puqxr[.]com hosting a “Point 72” Chinese investment platform featurin |
| domain | vip311.cc | ucture rather than as actual betting services. One example, vip311[.]cc, presented Chinese-language KY casino branding while embe |
From the original article
4 min read at gbhackers.com
China-aligned threat actors are using low-quality Chinese-language casino and adult websites to conceal PeckBirdy command-and-control infrastructure, creating a detection challenge for enterprises that routinely deprioritize gambling-related domains.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.