Low-quality casino sites conceal highly dangerous threat actors

A hidden threat lurks on seemingly harmless Chinese-language casino and adult websites, according to a new report from Infoblox. These sites may appear innocent, but they can also serve as command-and-control (C2) infrastructure for cyber espionage and malware distribution. The report highlights that about 1.7 million Chinese-language casino websites facilitate illegal gambling, tax avoidance, and North Korean money laundering, among other dubious activities.

Many of these sites use similar designs and functions, making them difficult to distinguish. Some of these sites rely on US cloud providers for computing infrastructure, likely due to account theft and "infrastructure laundering" practices. The UN Office on Drugs and Crime reports that cybercrime syndicates are increasingly using common infrastructure for illicit activities, leading to significant financial losses in East Asia, Southeast Asia, Australia, and New Zealand.

A subset of these sites, known as "scambig," trick users into placing bets and never allow them to withdraw their winnings. Additionally, some Chinese-aligned threat groups, using the PeckBirdy framework since 2023, hide their malware C2 domains within low-quality Chinese-language casino websites. PeckBirdy is a script-based framework that attackers can load through compromised websites, often injecting scripts that display fake software update pages to entice victims into downloading malware.

Infoblox advises security professionals to pay closer attention to these sites, as dismissing them as routine employee browsing violations may allow malicious actors to achieve their objectives. Analysts should carefully review suspicious network contacts involving casino domains to check for malicious payloads before closing the review ticket.