Infoblox Threat Intelligence said just over 3% of its enterprise customers resolved at least one domain associated with PeckBirdy, indicating that traffic linked to the campaign is appearing well beyond the narrow set of organisations previously connected with the activity. The company said the tactic exploits a common defensive blind spot because gambling and adult domains are often dismissed as policy violations rather than investigated as possible malware infrastructure.
The research, published on September 15, found that PeckBirdy operators are embedding malicious communications within low-quality Chinese-language websites designed to resemble the enormous population of illegal gambling pages already circulating online. Infoblox said it tracks about 1.7 million Chinese-language casino domains, creating substantial background noise in which malicious infrastructure can blend.
Researchers identified casino pages that loaded PeckBirdy-related JavaScript and established connections to command-and-control systems through WebSockets. One domain, mcp-source[.]online, had no detections on VirusTotal when Infoblox checked it on August 31, while cache-mcp[.]com had three detections and cache-cdn[.]org had 13. Infoblox said the weaker visibility around some domains illustrates how automated scanners can miss behaviour that depends on live browser execution or WebSocket connections.
The company also found Chinese-language adult websites being used in a similar way, broadening the decoy infrastructure associated with the campaign. It said defenders should avoid automatically closing alerts involving such sites after concluding that an employee merely visited prohibited content, because the same traffic may conceal malware communications or indicate a compromised host.
Trend Micro identified PeckBirdy earlier this year as a JScript-based command-and-control framework used by China-aligned advanced persistent threat actors since 2023. Its researchers said the framework was designed to run across different execution environments, including through legitimate Windows binaries, giving operators flexibility in how they deliver scripts and maintain access.
Trend Micro linked PeckBirdy to attacks against Chinese gambling businesses as well as government entities and private organisations in Asia. One campaign injected malicious scripts into gambling websites and displayed bogus software-update prompts intended to persuade users to install further malware. Other activity used compromised websites and native Windows tools to execute malicious code.
The framework has also been associated with follow-on malware, including backdoors used to maintain access after initial compromise. The precise identities of the operators remain unclear, and researchers have generally described them as China-aligned rather than naming a specific state-sponsored group.
Infoblox’s latest findings focus less on the malware’s code than on the infrastructure surrounding it. Researchers said they found PeckBirdy C2 domains hidden behind sites that are visually difficult to distinguish from ordinary illegal casinos, fraudulent betting pages and other low-quality web properties. That similarity complicates triage because many security teams already face large volumes of alerts involving gambling-related traffic.
The company said the technique benefits from defenders’ tendency to treat casino domains as low priority. A user browsing such a site may trigger an alert that appears to concern acceptable-use policy, while the page simultaneously loads JavaScript tied to a C2 endpoint. Infoblox advised security teams to inspect associated scripts, DNS requests and outbound connections before dismissing those events.
Investigators also highlighted the value of reviewing DNS telemetry for multiple PeckBirdy-related domains originating from the same network. Repeated resolution of distinct C2 addresses can provide a stronger indication of compromise than a single contact, particularly where browser-based behaviour makes conventional malware scanning less effective.
Education was the most prominent sector in Infoblox’s customer telemetry, while information technology, banking, financial services and government networks also appeared among leading categories. Researchers cautioned that one or two domain resolutions may have benign explanations, including a typo involving a GitHub-like hostname, whereas repeated contact with three or more distinct PeckBirdy domains merits closer investigation by defenders.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
