Low-quality casino sites conceal highly dangerous threat actors

Infoblox tracks about 1.7 million Chinese-language casino sites, some of which serve as C2 infrastructure for spy groups and malware distribution. The PeckBirdy framework has been hiding malware control domains inside such sites since 2023, with hosting partly through AWS, Microsoft, Cloudflare and Google.

• Infoblox tracks about 1.7 million Chinese-language casino sites
• PeckBirdy framework uses them for C2 domains since 2023
• Over 3% of Infoblox corporate clients contacted PeckBirdy domains
• Part of infrastructure hosted by Amazon, Microsoft, Cloudflare and Google