A vast network of Chinese-language gambling websites is helping threat actors conceal malware and espionage infrastructure. Researchers warn that security teams often dismiss these domains as harmless policy violations.
Researchers Track 1.7 Million Casino Sites
Infoblox says it tracks around 1.7 million Chinese-language casino websites linked to illegal gambling. According to the company, these operations also facilitate tax avoidance and North Korean money laundering.
However, researchers found a more direct cybersecurity threat within this sprawling network. Some sites conceal command-and-control infrastructure associated with the PeckBirdy malware framework.
Little-known China-aligned advanced persistent threat groups reportedly use PeckBirdy against corporate and government targets across Asia.
The scale of the casino ecosystem helps malicious activity blend into a large volume of suspicious but apparently ordinary gambling traffic. Consequently, defenders may overlook a serious intrusion after classifying an alert as an employee browsing violation.
PeckBirdy Uses Gambling Sites as Cover
PeckBirdy uses JScript, an older scripting language that can run across various execution environments. Threat actors have deployed the framework through Chinese-language gambling and adult websites.
Some of these sites provide actual illegal gambling services and even offer customer support. Mainland China has prohibited gambling for decades, but offshore operators continue targeting Chinese-speaking users.
Other websites merely imitate legitimate online casinos. Their gambling interfaces act as set dressing that hides malware delivery and command-and-control activity.
Infoblox also identified a PeckBirdy command-and-control domain that had no VirusTotal detections when the company published its findings. This allowed the infrastructure to operate without triggering warnings from the scanning service.
Fake Updates Trick Visitors Into Installing Malware
In one campaign, attackers injected malicious scripts into gambling websites. These scripts loaded PeckBirdy and displayed fraudulent software update pages.
The fake notices attempted to persuade visitors to download and install malware. Because the pages appeared through websites that already looked suspicious, security teams could easily misclassify the activity.
Researchers also found PeckBirdy links on compromised government websites. In other cases, attackers executed the framework through MSHTA.
MSHTA is a legitimate Windows component that runs Microsoft HTML Application code. Cybercriminals frequently abuse such trusted system tools because they can help malicious scripts avoid detection.
Major Cloud Platforms Host Parts of the Network
Some of the casino sites use infrastructure from major US cloud and technology providers. Researchers identified services associated with Amazon, Microsoft, Cloudflare and Google.
The companies may not knowingly support the malicious operations. Instead, attackers could be using stolen accounts or otherwise disguising the true ownership of their infrastructure.
Infoblox described this practice as infrastructure laundering. Threat actors use reputable hosting platforms to make malicious systems appear more trustworthy and harder to disrupt.
This approach creates a significant challenge for defenders. Blocking major cloud providers outright could interrupt legitimate business operations. Meanwhile, attackers can move between accounts, domains and services.
Security Teams May Dismiss Important Alerts
The Chinese casino malware network benefits from how organisations classify risky browsing activity.
A security alert involving a gambling or adult website may appear to show nothing more than an employee violating company policy. Therefore, an analyst might close the case without investigating the domain’s network connections or downloaded content.
PeckBirdy operators rely on this response. Most of these websites genuinely resemble the illegal gambling or adult platforms they claim to be, making the initial dismissal seem reasonable.
However, the same domains may load malicious scripts, redirect visitors to fake updates or communicate with command-and-control servers.
Defenders Should Investigate Casino Domains
Infoblox urges security teams to stop treating all casino-domain alerts as routine browsing incidents. Analysts should inspect related downloads, scripts, redirects and external connections before closing an alert.
They should also examine activity involving unfamiliar Chinese-language gambling and adult websites. Connections to reputable cloud infrastructure should not automatically make a domain safe.
The research shows how attackers can hide sophisticated campaigns inside an ecosystem that defenders already consider disreputable. By exploiting that assumption, Chinese casino malware operators can conceal espionage activity in plain sight.
0 responses to “Chinese Casino Malware Network Hides PeckBirdy Attacks”