China-aligned advanced persistent threat (APT) actors have deployed the PeckBirdy JScript-based C&C framework since 2023 to target gambling sites and Asian governments.
This versatile tool enables multi-environment attacks, including stolen certificate abuse in Cobalt Strike payloads.
Key Takeaways
- PeckBirdy supports browsers, MSHTA, WScript, ASP, Node.js, and .NET for flexible LOLBin exploitation.
- Campaigns SHADOW-VOID-044 and SHADOW-EARTH-045 deliver backdoors like HOLODONUT and MKDOOR.
- Stolen code-signing certificates mask Cobalt Strike in persistent access operations.
Campaign Overview
Trend Micro researchers first spotted PeckBirdy in 2023 targeting Chinese gambling sites via injected scripts that fetch the main loader.
Victims see fake Chrome update pages prompting malicious downloads, tracked as SHADOW-VOID-044.
A second effort, SHADOW-EARTH-045 from July 2024, hit Asian governments and firms with website injections for credential theft or MSHTA lateral movement.
PeckBirdy acts as a watering-hole controller early, reverse shell mid-attack, and full C&C later.
Framework Design
PeckBirdy uses outdated JScript for broad compatibility, auto-detecting environments via unique objects like “window” for browsers or “process” for Node.js.
It generates victim IDs from hardware hashes (MD5) or random strings, storing them in cookies or temp files named unique_id.
Configs embed per attack ID (32-char random string), dictating host, ports, retries, and heartbeats.
| Config | Description |
|---|---|
| $HOST | C&C server domain |
| $PORT | Protocol ports |
| $ATTACK_ID | 32-char identifier |
| $RETRY | Retry wait time |
| $RETRY_TIME | Retry attempts |
| $HEARTBEAT | Heartbeat interval |
Server APIs serve tailored landing scripts.
| API Path | Purpose |
|---|---|
| /{ATTACK_ID} | Main PeckBirdy script |
| /{ATTACK_ID}/hta | MSHTA landing |
| /{ATTACK_ID}/html | HTML/MTML landing |
| /{ATTACK_ID}/wscript | WScript landing |
Comms prioritize WebSocket, fall back to Flash sockets, Comet, or HTTP/AJAX; payloads use AES (key=ATTACK_ID) + Base64. Scripts steal cookies or exploit CVE-2020-16040 in Chrome.
Backdoor Extensions
SHADOW-VOID-044 infrastructure hosted HOLODONUT (.NET modular backdoor) and MKDOOR. HOLODONUT loads via NEXLOAD downloader, evades AMSI/ETW, runs shellcode via Donut in memory.
MKDOOR’s downloader fetches the core, adds Defender exclusions, mimics Microsoft URLs like /en-us/howtotell/default.aspx.
Core uses /en-us/windows/activate-windows… for C2; supports modular install/execute.
Both open local HTTP servers for infection checks.
Attribution Links
SHADOW-VOID-044 ties to UNC3569 (gambling focus, GRAYRABBIT overlap) and TheWizard (HOLODONUT C2 reuse).
A Cobalt Strike payload used a stolen South Korean gaming cert (thumbprint: bbd2b9b87f968ed88210d4261a1fe30711e8365b), echoing BIOPASS RAT/Earth Lusca tactics.
SHADOW-EARTH-045 hints at Earth Baxia (Philippine edu target, IP 47.238.184.9 overlap).
Detection Tips
Hunt IOCs like domains (oss-cdn[.]com, mkdmcdn[.]com) via Trend Vision One queries: (MKDOOR OR HOLODONUT OR PECKBIRDY) AND MALWARE_DETECTION. Block multi-vector LOLBins, monitor JScript injections, and scan for stolen certs.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 actors have deployed the PeckBirdy JScript-based C&C framework since 2023 to target){kind=link}