Infoblox says large numbers of Chinese-language casino and adult websites are not just illegal gambling fronts but also infrastructure for malware and espionage campaigns. The report says China-aligned APT groups have used the PeckBirdy script-based framework since 2023 to hide command-and-control servers inside these domains, and in some cases injected scripts into gambling sites to show fake software update pages that delivered malware. Infoblox says about 3 percent of its enterprise customers resolved at least one PeckBirdy C2 domain.
Why it matters: This broadens what defenders should treat as high-risk traffic: visits to low-quality gambling or adult domains may signal exposure to malware or espionage infrastructure, not just policy violations. Organizations should review web filtering, hunt for known PeckBirdy-related domains, and treat alerts involving these sites as potential incident leads.
2026.09.15
100% relevant
This article establishes the story by tying a specific malware framework, PeckBirdy, to a concrete class of infrastructure—Chinese-language casino and adult domains—and by adding enterprise exposure data and operational guidance for defenders.
← Back to all stories