Hackers Are Hiding Espionage Infrastructure Inside Ordinary-Looking Casino Websites
Infoblox links China-aligned APT PeckBirdy C2 infrastructure hidden in casino and adult websites targeting Asian government, finance, IT, and education sectors.
Infoblox researchers report that China-aligned APT groups have used casino and adult websites as cover for PeckBirdy, a JavaScript command-and-control framework active since 2023. The sites embed C2 servers, register service workers for persistence, and serve fake browser-update prompts delivering backdoors capable of running commands, stealing credentials, and providing remote access. Targeted sectors across Asia include education, IT, banking, financial services, and government. Just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with detection coverage on VirusTotal ranging from 13 detections to none.
- PeckBirdy is a JavaScript C2 framework used by China-aligned APTs since 2023
- Casino and adult sites act as cover for WebSocket C2 and service-worker persistence
- Fake browser-update prompts deliver backdoors with credential theft and remote access
- ~3% of enterprise customers resolved at least one PeckBirdy C2 domain
- Defenders urged to correlate DNS, proxy, and browser telemetry; single-domain blocking ineffective
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 11168833.com | ersonating an investment platform Casino domains 80074.cc , 11168833.com Near-identical casino sites using different branding Casino |
| domain | 11170011.com | he researchers’ comparison of lookalike pages Casino domain 11170011.com Illegal Chinese-language casino site using impersonated bra |
| domain | 1862.cc | ently active casino-site examples Redirecting casino domain 1862.cc Casino site that fingerprinted visitors and redirected them |
| domain | 312zym001.cc | ntical casino sites using different branding Casino domains 312zym001.cc , am125.cc , 843470.cc Recently active casino-site examples |
| domain | 80074.cc | om Site impersonating an investment platform Casino domains 80074.cc , 11168833.com Near-identical casino sites using different |
| domain | 843470.cc | different branding Casino domains 312zym001.cc , am125.cc , 843470.cc Recently active casino-site examples Redirecting casino dom |
| domain | am125.cc | ites using different branding Casino domains 312zym001.cc , am125.cc , 843470.cc Recently active casino-site examples Redirectin |
| domain | appcasino.online | site promoted through injected comment spam Redirect domain appcasino.online Domain reached through clicks on dragobet.net Scam gambling |
| domain | asg78.com | mbling site advertising a deposit bonus Casino decoy domain asg78.com Chinese-language casino domain observed loading a suspiciou |
| domain | cache-cdn.org | ated PeckBirdy domain used to collect connections C2 domain cache-cdn.org Previously identified PeckBirdy domain with VirusTotal dete |
| domain | cache-mcp.com | m/layer.js Suspicious payload loaded by asg78.com C2 domain cache-mcp.com PeckBirdy command-and-control domain embedded in casino pag |
| domain | dollycasino.com | ing 1862.cc from a Japanese IP address Scam gambling domain dollycasino.com Scam gambling site associated with complaints about withdra |
| domain | dragobet.net | h complaints about withdrawal problems Scam gambling domain dragobet.net Scam gambling site promoted through injected comment spam R |
| domain | githubassets.net | VirusTotal detections Possible typosquat/C2-related domain githubassets.net Historical PeckBirdy domain that may also receive accidenta |
| domain | js.cache-mcp.com | ng a suspicious JavaScript payload Malicious JavaScript URL js.cache-mcp.com/layer.js Suspicious payload loaded by asg78.com C2 domain c |
| domain | mcp-source.online | mmand-and-control domain embedded in casino pages C2 domain mcp-source.online WebSocket-related PeckBirdy domain used to collect connecti |
| domain | puqxr.com | ino site using impersonated branding Investment scam domain puqxr.com Site impersonating an investment platform Casino domains 80 |
| domain | realz.com | ambling site using misleading branding Scam gambling domain realz.com Scam gambling site advertising a deposit bonus Casino decoy |
| domain | vip311.cc | operators can hide. Three casino sites from left to right, vip311[.]cc, zzyud[.]com, zenplay77-x[.]space; vip311[.]cc is associa |
| domain | zenplay77-x.space | casino sites from left to right, vip311[.]cc, zzyud[.]com, zenplay77-x[.]space; vip311[.]cc is associated with PeckBirdy (Source – Infob |
| domain | zzyud.com | n hide. Three casino sites from left to right, vip311[.]cc, zzyud[.]com, zenplay77-x[.]space; vip311[.]cc is associated with Peck |
| ipv4 | 146.103.91.133 | en accessing 1862.cc from a Hong Kong IP address IP address 146.103.91.133 Final destination observed when accessing 1862.cc from a Ja |
| ipv4 | 157.185.143.150 | printed visitors and redirected them by location IP address 157.185.143.150 Final destination observed when accessing 1862.cc from a Ho |
From the original article
5 min read at cybersecuritynews.com
Ordinary-looking casino websites are being used to conceal infrastructure for cyberespionage. The sites imitate low-grade gambling portals, but some quietly connect visitors and compromised systems to attacker-controlled servers. The pages are built to appear disposable and harmless, which can lower the chance that they receive security scrutiny.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.