Low-quality casino sites conceal highly dangerous threat actors
Infoblox reveals China-aligned APT groups hiding PeckBirdy malware C2 domains inside roughly 1.7 million Chinese-language illegal casino websites.
An Infoblox report says it tracks about 1.7 million Chinese-language casino sites enabling illegal gambling, some of which double as command-and-control infrastructure. China-aligned APT groups have hidden PeckBirdy framework C2 domains inside these low-quality casino sites since 2023, injecting scripts that display fake software update pages to deliver malware. Over 3 percent of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, and some sites rely on US cloud providers via 'infrastructure laundering.' Infoblox urges defenders not to dismiss casino-domain alerts as mere employee browsing violations.
- China-aligned APTs hide PeckBirdy C2 in Chinese-language casino sites since 2023
- Over 3% of Infoblox enterprise customers resolved a PeckBirdy C2 domain
- Injected scripts display fake update pages to deliver malware
- Some malicious sites rely on US cloud providers via 'infrastructure laundering'
- Defenders should not dismiss casino-domain alerts as browsing violations
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | vip311.cc | e. Screenshots of three casino sites identified by Infoblox—vip311[.]cc, zzyud[.]com and zenplay77-x[.]space—with vip311[.]cc ass |
| domain | zenplay77-x.space | o sites identified by Infoblox—vip311[.]cc, zzyud[.]com and zenplay77-x[.]space—with vip311[.]cc associated with PeckBirdy. The problem i |
| domain | zzyud.com | s of three casino sites identified by Infoblox—vip311[.]cc, zzyud[.]com and zenplay77-x[.]space—with vip311[.]cc associated with |
From the original article
2 min read at theregister.comSecurity firm Infoblox shines light on malicious infrastructure lurking beneath illegal gambling sites
By Thomas Claburn · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.