PeckBirdy Malware Uses Chinese Casino and Adult Websites to Hide APT Command-and-Control

China-aligned advanced persistent threat (APT) groups are using low-quality Chinese-language casino and adult websites to conceal command-and-control (C2) infrastructure linked to the PeckBirdy malware framework.

The tactic helps attackers blend malicious network activity into a vast ecosystem of suspicious gambling sites that many security teams may dismiss as unwanted browsing or low-priority web traffic.

Researchers found that PeckBirdy operators have used this approach since at least 2023 to target corporate and government organizations across Asia.

PeckBirdy is a flexible JScript-based framework that can support multi-stage intrusions and malware delivery.

Earlier reporting connected the framework to campaigns using living-off-the-land binaries, while the latest analysis shows its operators expanding the use of casino-themed decoy sites and Chinese-language adult portals.

PeckBirdy Hides in Casinos

One example identified by researchers is vip311.cc, a Chinese-language casino site that embedded the PeckBirdy C2 domain cache-mcp.com.

The malicious JavaScript established a service worker and created WebSocket-based communications with another domain, mcp-source.online.

This layered setup can make detection harder because automated scanners do not always execute the browser behavior needed to reveal the connection.

The casino pages are designed to look similar to millions of other questionable gambling sites. They may use copied branding, game offers, promotional graphics, and Chinese-language content.

This visual similarity gives attackers cover because analysts may classify the traffic as a policy violation rather than investigate it as a potential intrusion.

Researchers divide suspicious gambling websites into three broad categories: illegal Chinese-language casinos, scam gambling sites, and PeckBirdy-operated decoy sites.

The first category supports illegal gambling and money laundering, while scam gambling sites typically lure victims with bonuses and block them from withdrawing funds.

PeckBirdy sites, however, are not intended to attract real players. They are set dressing for C2 activity and cyber espionage. The scale of the broader casino ecosystem makes the technique particularly effective.

Researchers track more than 1.7 million Chinese-language casino domains, creating large amounts of web traffic, hosting activity, and domain churn that can obscure a small number of malicious APT-controlled sites.

The threat actors also appear to use infrastructure patterns similar to those found in the wider casino ecosystem.

Their domains have been associated with hosting providers in the United States, Europe, China, Hong Kong, Singapore, and other Asia-Pacific locations.

Such overlap complicates infrastructure-based detection because hosting location alone does not reliably identify a malicious site, infoblox said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team