Casino Websites Are Hiding Money Laundering, Scams and China-Aligned Espionage
More than 1.7 million casino domains fuel a criminal ecosystem
More than 1.7 million casino domains fuel a criminal ecosystem
Casino Websites Are Hiding Money Laundering, Scams and China-Aligned Espionage
Infoblox found casino websites hiding scams, money laundering, and PeckBirdy C2 infrastructure linked to China-aligned threat groups.
www.esecurityplanet.com
September 21, 2026 at 5:19 PM
Casino Websites Are Hiding Money Laundering, Scams and China-Aligned Espionage
More than 1.7 million casino domains fuel a criminal ecosystem
More than 1.7 million casino domains fuel a criminal ecosystem
PeckBirdyのC2通信、カジノドメインに偽装して企業ネットワーク全体で観測
中国と関係の深い脅威アクターが、質の低い中国語カジノサイトやアダルトサイトを利用してPeckBirdyのコマンド&コントロール(C2)インフラを隠蔽していることが分かりました。企業はギャンブル関連ドメインを日常的に優先度低として扱う傾向があるため、これが検知上の課題を生み出しています。 Infobloxのテレメトリに
中国と関係の深い脅威アクターが、質の低い中国語カジノサイトやアダルトサイトを利用してPeckBirdyのコマンド&コントロール(C2)インフラを隠蔽していることが分かりました。企業はギャンブル関連ドメインを日常的に優先度低として扱う傾向があるため、これが検知上の課題を生み出しています。 Infobloxのテレメトリに
PeckBirdyのC2通信、カジノドメインに偽装して企業ネットワーク全体で観測
中国と関係の深い脅威アクターが、質の低い中国語カジノサイトやアダルトサイトを利用してPeckBirdyのコマンド&コントロール(C2)インフラを隠蔽していることが分かりました。企業はギャンブル関連ドメインを日常的に優先度低として扱う傾向があるため、これが検知上の課題を生み出しています。 Infobloxのテレメトリに
blackhatnews.tokyo
September 18, 2026 at 1:48 PM
PeckBirdyのC2通信、カジノドメインに偽装して企業ネットワーク全体で観測
中国と関係の深い脅威アクターが、質の低い中国語カジノサイトやアダルトサイトを利用してPeckBirdyのコマンド&コントロール(C2)インフラを隠蔽していることが分かりました。企業はギャンブル関連ドメインを日常的に優先度低として扱う傾向があるため、これが検知上の課題を生み出しています。 Infobloxのテレメトリに
中国と関係の深い脅威アクターが、質の低い中国語カジノサイトやアダルトサイトを利用してPeckBirdyのコマンド&コントロール(C2)インフラを隠蔽していることが分かりました。企業はギャンブル関連ドメインを日常的に優先度低として扱う傾向があるため、これが検知上の課題を生み出しています。 Infobloxのテレメトリに
Chinese-language casino sites are being used to hide PeckBirdy malware, researchers say. 1.7M+ sites tracked, some just cover infrastructure.
https://www.gambling.com/news/chinese-language-casino-sites-used-to-hide-peckbirdy-malware
18+ | GambleAware | #CasinoNews
https://www.gambling.com/news/chinese-language-casino-sites-used-to-hide-peckbirdy-malware
18+ | GambleAware | #CasinoNews
September 17, 2026 at 1:22 PM
Chinese-language casino sites are being used to hide PeckBirdy malware, researchers say. 1.7M+ sites tracked, some just cover infrastructure.
https://www.gambling.com/news/chinese-language-casino-sites-used-to-hide-peckbirdy-malware
18+ | GambleAware | #CasinoNews
https://www.gambling.com/news/chinese-language-casino-sites-used-to-hide-peckbirdy-malware
18+ | GambleAware | #CasinoNews
中国系ハッカー集団、PeckBirdyマルウェアのC2をカジノ・アダルトサイトに潜伏させる
中国と関係の深い脅威アクターが、C2(指令制御)フレームワーク「PeckBirdy」を、低品質な中国語カジノサイトやアダルトサイトの中に隠していることが分かりました。 普段は見過ごされがちなインターネットインフラの広大な領域を悪用し、マルウェア通信をギャンブルサイトの通常アクセスに見せかける手口です。マルウェア分析ツ
中国と関係の深い脅威アクターが、C2(指令制御)フレームワーク「PeckBirdy」を、低品質な中国語カジノサイトやアダルトサイトの中に隠していることが分かりました。 普段は見過ごされがちなインターネットインフラの広大な領域を悪用し、マルウェア通信をギャンブルサイトの通常アクセスに見せかける手口です。マルウェア分析ツ
中国系ハッカー集団、PeckBirdyマルウェアのC2をカジノ・アダルトサイトに潜伏させる
中国と関係の深い脅威アクターが、C2(指令制御)フレームワーク「PeckBirdy」を、低品質な中国語カジノサイトやアダルトサイトの中に隠していることが分かりました。 普段は見過ごされがちなインターネットインフラの広大な領域を悪用し、マルウェア通信をギャンブルサイトの通常アクセスに見せかける手口です。マルウェア分析ツ
blackhatnews.tokyo
September 16, 2026 at 9:19 AM
中国系ハッカー集団、PeckBirdyマルウェアのC2をカジノ・アダルトサイトに潜伏させる
中国と関係の深い脅威アクターが、C2(指令制御)フレームワーク「PeckBirdy」を、低品質な中国語カジノサイトやアダルトサイトの中に隠していることが分かりました。 普段は見過ごされがちなインターネットインフラの広大な領域を悪用し、マルウェア通信をギャンブルサイトの通常アクセスに見せかける手口です。マルウェア分析ツ
中国と関係の深い脅威アクターが、C2(指令制御)フレームワーク「PeckBirdy」を、低品質な中国語カジノサイトやアダルトサイトの中に隠していることが分かりました。 普段は見過ごされがちなインターネットインフラの広大な領域を悪用し、マルウェア通信をギャンブルサイトの通常アクセスに見せかける手口です。マルウェア分析ツ
NDD expiré, gambling et malware
"PeckBirdy and Sable Squirrel : controlling more than 10,000 domains and spending an estimated $7 million on expired domains to build a streaming and gambling empire that also functions as malware C2 infrastructure."
www.infoblox.com/blog/threat-...
"PeckBirdy and Sable Squirrel : controlling more than 10,000 domains and spending an estimated $7 million on expired domains to build a streaming and gambling empire that also functions as malware C2 infrastructure."
www.infoblox.com/blog/threat-...
September 16, 2026 at 7:31 AM
NDD expiré, gambling et malware
"PeckBirdy and Sable Squirrel : controlling more than 10,000 domains and spending an estimated $7 million on expired domains to build a streaming and gambling empire that also functions as malware C2 infrastructure."
www.infoblox.com/blog/threat-...
"PeckBirdy and Sable Squirrel : controlling more than 10,000 domains and spending an estimated $7 million on expired domains to build a streaming and gambling empire that also functions as malware C2 infrastructure."
www.infoblox.com/blog/threat-...
PeckBirdy's JScript C2 hides inside fake casino sites - and inside your browser, Node, and .NET too. https://intel.threadlinqs.com/threat/TL-2026-2527 #ThreatIntel #CVE_2020_16040 #PeckBirdy #HOLODONUT
September 16, 2026 at 12:32 AM
PeckBirdy's JScript C2 hides inside fake casino sites - and inside your browser, Node, and .NET too. https://intel.threadlinqs.com/threat/TL-2026-2527 #ThreatIntel #CVE_2020_16040 #PeckBirdy #HOLODONUT
Illegal gambling sites are being used for money laundering, scam gambling, and as decoys for PeckBirdy command-and-control malware hidden in Chinese-language casino and adult sites. #PeckBirdy #China #Gambling
Illegal Gambling Sites Reveal Three Types Of Cybercrime
This report explains how illicit casino websites are used for illegal gambling, money laundering, scam gambling, and as decoys for PeckBirdy command-and-control infrastructure. It shows that China-aligned APT groups hide malware endpoints inside Chinese-language casino and adult sites, with domains like vip311[.]cc, cache-mcp[.]com, and mcp-source[.]online slipping past detection. #PeckBirdy #vip311[.]cc #cache-mcp[.]com #mcp-source[.]online
www.hendryadrian.com
September 16, 2026 at 1:15 AM
Illegal gambling sites are being used for money laundering, scam gambling, and as decoys for PeckBirdy command-and-control malware hidden in Chinese-language casino and adult sites. #PeckBirdy #China #Gambling
Check out the Trend Micro research into PeckBirdy from January 2026, "PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups" @ www.trendmicro.com/en/research/...
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries a...
www.trendmicro.com
September 15, 2026 at 5:33 PM
Check out the Trend Micro research into PeckBirdy from January 2026, "PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups" @ www.trendmicro.com/en/research/...
~Infoblox~
Casino and adult sites conceal China-aligned PeckBirdy C2 infrastructure.
-
IOCs: mcp-source[.]online, cache-mcp[.]com, vip311[.]cc
-
#APT #Malware #ThreatIntel
Casino and adult sites conceal China-aligned PeckBirdy C2 infrastructure.
-
IOCs: mcp-source[.]online, cache-mcp[.]com, vip311[.]cc
-
#APT #Malware #ThreatIntel
Casino Sites Hide PeckBirdy C2
www.infoblox.com
September 15, 2026 at 4:06 PM
~Infoblox~
Casino and adult sites conceal China-aligned PeckBirdy C2 infrastructure.
-
IOCs: mcp-source[.]online, cache-mcp[.]com, vip311[.]cc
-
#APT #Malware #ThreatIntel
Casino and adult sites conceal China-aligned PeckBirdy C2 infrastructure.
-
IOCs: mcp-source[.]online, cache-mcp[.]com, vip311[.]cc
-
#APT #Malware #ThreatIntel
The threat actors behind the PeckBirdy campaign are out of China – and my personal read on this is that I believe they are government aligned groups based on their sophistication and targeting. TBD!
September 15, 2026 at 5:33 PM
The threat actors behind the PeckBirdy campaign are out of China – and my personal read on this is that I believe they are government aligned groups based on their sophistication and targeting. TBD!
We still don’t know much about the operators using PeckBirdy, but their ongoing 2026 campaign has been a smashing success if the lack of VirusTotal detections for their C2 domains are any indication.
September 15, 2026 at 5:33 PM
We still don’t know much about the operators using PeckBirdy, but their ongoing 2026 campaign has been a smashing success if the lack of VirusTotal detections for their C2 domains are any indication.
Our report today covers the growing PeckBirdy campaign, the illegal Chinese-language casino websites facilitating illegal gambling and vast money laundering networks, and the “scambling” or scam gambling websites which have been scaling up their targeting of people globally.
September 15, 2026 at 5:33 PM
Our report today covers the growing PeckBirdy campaign, the illegal Chinese-language casino websites facilitating illegal gambling and vast money laundering networks, and the “scambling” or scam gambling websites which have been scaling up their targeting of people globally.
These attackers are now also using Chinese-language adult websites to hide their C2 comms and we’ve seen a dramatic scaling up of these PeckBirdy attacks in 2026, with 3% of Infoblox customers across nearly all industry sectors, being targeted.
September 15, 2026 at 5:33 PM
These attackers are now also using Chinese-language adult websites to hide their C2 comms and we’ve seen a dramatic scaling up of these PeckBirdy attacks in 2026, with 3% of Infoblox customers across nearly all industry sectors, being targeted.
Congrats. Because of your lack of concern for these casino websites, there’s now been a multi-year growing APT campaign out of China which uses a C2 framework called PeckBirdy which is embedded into low quality Chinese-language casino websites to hide amongst the noise.
September 15, 2026 at 5:33 PM
Congrats. Because of your lack of concern for these casino websites, there’s now been a multi-year growing APT campaign out of China which uses a C2 framework called PeckBirdy which is embedded into low quality Chinese-language casino websites to hide amongst the noise.
When a compromised victim goes to one of these PeckBirdy domains, defenders are more likely to ignore it in logs because “it’s just another low quality casino website.”
Beyond Infoblox, Trend Micro is pretty much the only other org who has done solid research on this campaign.
Beyond Infoblox, Trend Micro is pretty much the only other org who has done solid research on this campaign.
September 15, 2026 at 5:33 PM
When a compromised victim goes to one of these PeckBirdy domains, defenders are more likely to ignore it in logs because “it’s just another low quality casino website.”
Beyond Infoblox, Trend Micro is pretty much the only other org who has done solid research on this campaign.
Beyond Infoblox, Trend Micro is pretty much the only other org who has done solid research on this campaign.
In our research, we highlighted a web socket method technique that PeckBirdy has embedded into the low quality Chinese-language casino and adult websites they are using – and one of the active C2 domains in this campaign has literally zero detections on VirusTotal.
The Simpsons: Big Fat Zero Score
Alt: The Simpsons: Big Fat Zero Score
static.klipy.com
September 15, 2026 at 5:33 PM
In our research, we highlighted a web socket method technique that PeckBirdy has embedded into the low quality Chinese-language casino and adult websites they are using – and one of the active C2 domains in this campaign has literally zero detections on VirusTotal.
Before I get into more details, can you guess which of the three websites below is used by a Chinese APT who purposefully hides their malware C2 comms within low quality Chinese-language casino and adult websites with the hopes of defenders ignoring alerts on those domains?
![Figure 1. Screenshots of three casino sites from left to right, vip311[.]cc, zzyud[.]com, zenplay77-x[.]space; vip311[.]cc is associated with PeckBirdy](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fyqv2rchqyrfrjv63ltu3oca/bafkreifjkl7m6cbitehvomyp3iyuwtevmo7ck4dpr3gx6mkl7kniv5khue)
September 15, 2026 at 5:33 PM
Before I get into more details, can you guess which of the three websites below is used by a Chinese APT who purposefully hides their malware C2 comms within low quality Chinese-language casino and adult websites with the hopes of defenders ignoring alerts on those domains?
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks: https://bit.ly/4rp5qoy by Elizabeth Montalbano
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
In two separate campaigns, attackers used the JScript C2 framework to target Chinese gambling websites and Asian government entities with new backdoors.
bit.ly
January 28, 2026 at 10:09 PM
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks: https://bit.ly/4rp5qoy by Elizabeth Montalbano
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
www.trendmicro.com/de_de/resear... #China #Chinese #cyber #warfare #hack #hackers #Hacked #PeckyBirdy
www.trendmicro.com/de_de/resear... #China #Chinese #cyber #warfare #hack #hackers #Hacked #PeckyBirdy
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries a...
www.trendmicro.com
January 27, 2026 at 7:14 PM
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
www.trendmicro.com/de_de/resear... #China #Chinese #cyber #warfare #hack #hackers #Hacked #PeckyBirdy
www.trendmicro.com/de_de/resear... #China #Chinese #cyber #warfare #hack #hackers #Hacked #PeckyBirdy
China-linked hackers have been using the PeckBirdy JavaScript C2 framework since 2023 to deliver malicious scripts and backdoors across multiple environments.
sctocs.com/china-linked...
sctocs.com/china-linked...
China Linked Hackers Have Been Using The PeckBirdy JavaScript C2 Framework Since 2023 - SCtoCS
China linked hackers have been deploying the PeckBirdy JavaScript C2 framework since 2023 to conduct targeted cyber operations.
sctocs.com
January 28, 2026 at 10:03 AM
China-linked hackers have been using the PeckBirdy JavaScript C2 framework since 2023 to deliver malicious scripts and backdoors across multiple environments.
sctocs.com/china-linked...
sctocs.com/china-linked...
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
thehackernews.com/2026/01/chin...
thehackernews.com/2026/01/chin...
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
Experts details PeckBirdy, a JavaScript C2 framework used since 2023 by China-aligned attackers to spread malware via fake updates & web injections.
thehackernews.com
January 27, 2026 at 9:35 AM
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
thehackernews.com/2026/01/chin...
thehackernews.com/2026/01/chin...
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
www.darkreading.com
January 31, 2026 at 4:01 PM
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
Trend Micro uncovers PeckBirdy, a JavaScript C2 framework linked to China-aligned APTs since 2023. Tied to modular backdoors, stolen certificates, Cobalt Strike, and CVE-2020-16040 exploits. #PeckBirdy #ChinaAPT #CodeSigning
Probing the DNS Depths of PeckBirdy
Trend Micro's report exposes PeckBirdy, a JavaScript-based C2 framework used by China-aligned APTs since 2023 and linked to modular backdoors (HOLODONUT, MKDOOR), stolen code-signing certificates, Cobalt Strike payloads, and exploits including CVE-2020-16040. Researchers analyzed 56 IoCs (domains, subdomains, IPs, WHOIS emails), confirmed many as illegitimate or previously weaponized, and published sample artifacts and full findings for download. #PeckBirdy #HOLODONUT
www.hendryadrian.com
March 14, 2026 at 6:00 AM
Trend Micro uncovers PeckBirdy, a JavaScript C2 framework linked to China-aligned APTs since 2023. Tied to modular backdoors, stolen certificates, Cobalt Strike, and CVE-2020-16040 exploits. #PeckBirdy #ChinaAPT #CodeSigning
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
In two separate campaigns, attackers used the JScript C2 framework to target Chinese gambling websites and Asian government entities with new backdoors.
www.darkreading.com
January 28, 2026 at 5:17 PM
China-Backed 'PeckBirdy' Takes Flight for Cross-Platform Attacks
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
thehackernews.com
January 27, 2026 at 11:58 AM
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023