Chinese gambling sites double as malware hubs for cybercriminals
Infoblox report reveals North Korean money laundering and APT infrastructure hidden in casino domains
1Malware disguised as entertainment
Chinese-language gambling and adult sites are being used as fronts for malware distribution and espionage operations. Infoblox tracks 1.7 million such domains that facilitate illegal gambling while simultaneously serving as command-and-control infrastructure. These sites often appear legitimate, using common casino templates, making them difficult to distinguish from harmless entertainment platforms.
2North Korean financial pipelines
Beyond cyber threats, these casino sites support North Korean money laundering and tax evasion operations. The UNODC estimates online scams caused $88.3-$114.1 billion in losses across Asia-Pacific in 2025. Criminal syndicates increasingly share common infrastructure, with some casino sites offering outright scams where winners can't withdraw funds.
3US cloud infrastructure abuse
Despite hosting illegal activities, many sites operate on major US cloud providers like AWS, Microsoft, and Google. Infoblox suggests this occurs through stolen cloud accounts in a practice called 'infrastructure laundering.' Companies like Funnull have rented AWS/Microsoft IPs and resold them to criminals, creating deniable infrastructure.
4PeckBirdy APT framework
China-aligned threat groups have used the PeckBirdy framework since 2023, hiding malware C2 domains within casino sites. Trend Micro researchers documented attackers injecting scripts that display fake update pages to deliver malware. The framework's script-based nature allows easy deployment through compromised websites.
5Enterprise exposure levels
Infoblox found over 3% of its enterprise customers resolved at least one PeckBirdy C2 domain. The security firm warns that dismissing casino domain alerts as mere policy violations plays into attackers' hands, as the domains' legitimate appearance makes malicious use hard to detect without deeper inspection.
6Detection challenges
Three distinct threat types—illegal gambling, outright scams, and APT infrastructure—all use similar-looking casino domains that change frequently. Security teams are advised to check for malicious payloads before closing investigation tickets, as the sites' dual nature makes blanket dismissal risky.
7Infrastructure laundering tactics
The report details how criminals exploit cloud providers' stolen accounts to create disposable infrastructure. This 'laundering' makes attribution difficult, as the infrastructure appears legitimate until abused. Hosting providers like Funnull act as intermediaries, renting clean IPs to bad actors.
8Security recommendations
Infoblox urges defenders to stop ignoring casino domains in security monitoring. Analysts should verify whether suspicious casino contacts contain malicious elements, as dismissing them outright enables APT operations. The blend of criminal activities in these domains requires more nuanced security responses.