As cited
Copy frozen at (site build).
threat intel
Low-quality casino sites conceal highly dangerous threat actors
Chinese-language casino and adult entertainment websites, numbering roughly 1.7 million, frequently host command-and-control (C2) infrastructure for malware distribution and espionage. Infoblox reports that China-aligned advanced persistent threat (APT) groups have embedded the PeckBirdy framework into these sites since 2023, using fake software update pages to trick visitors into downloading malware. Major US cloud providers including Amazon, Microsoft, Cloudflare, and Google inadvertently host infrastructure for these domains, likely through account compromise and resale by intermediate hosting firms.
Why it matters: Security teams dismiss alerts on Chinese-language gambling and adult domains as employee policy violations and close tickets without investigation, allowing PeckBirdy C2 domains to evade detection; over 3 percent of Infoblox enterprise customers resolved at least one such domain, creating direct exposure to malware deployment campaigns.
- Source published
- First seen by Cybersecurity Tracker