China-aligned hackers have weaponized a JScript-based command-and-control (C&C) framework called PeckBirdy since 2023. This tool abuses living-off-the-land binaries (LOLBins) like MSHTA and WScript to run across browsers, servers, and local machines.
It powers watering-hole attacks, lateral movement, and backdoor delivery against Chinese gambling sites, Asian governments, and private firms.
Trend Micro tracks two campaigns SHADOW-VOID-044 and SHADOW-EARTH-045 linking them to advanced persistent threats (APTs). PeckBirdy pairs with modular backdoors HOLODONUT and MKDOOR for persistence.
Campaigns In Action
Trend Micro first spotted PeckBirdy in 2023 injecting scripts into Chinese gambling sites. Victims hitting these pages download PeckBirdy, which shows fake Chrome update pop-ups.
These trick users into running backdoors. Named SHADOW-VOID-044, this campaign hosts exploits for CVE-2020-16040 a Chrome flaw across C&C domains and IPs. Attackers also use Cobalt Strike payloads signed with stolen South Korean certificates.
In July 2024, SHADOW-EARTH-045 hit Asian governments and firms. Hackers injected PeckBirdy into login pages for credential theft.
One case used MSHTA on a private network for remote access; another launched it via a .NET tool with ScriptControl. PeckBirdy adapts: as a watering-hole server early on, reverse shell mid-attack, and full C&C later.
PeckBirdy grabs landing scripts from C&C servers via simple HTTP queries. Each uses a 32-character ATTACK_ID for custom configs.
| API Path | Description |
|---|---|
| /{ATTACK_ID} | Main PeckBirdy script |
| /{ATTACK_ID}/hta | MSHTA landing script |
| /{ATTACK_ID}/html | HTML landing script |
| /{ATTACK_ID}/wscript | WScript landing script |
Configs control servers, ports, retries, and heartbeats.
| Config Key | Description |
|---|---|
| $HOST | C&C domain |
| $PORT | Protocol ports |
| $ATTACK_ID | 32-char random string |
| $RETRY | Retry wait time |
| $RETRY_TIME | Retry attempts |
| $HEARTBEAT | Heartbeat interval |
Framework and Backdoors
PeckBirdy detects environments via objects like “window” (browser) or “process” (Node.js). It IDs victims with hardware hashes or random strings, stored in cookies or temp files like unique_id.
Communication starts with WebSocket; fallbacks use Flash sockets, Comet, or AJAX. Init packets share victim details; servers reply with AES-encrypted scripts (key: ATTACK_ID).
Hackers extend PeckBirdy with backdoors. HOLODONUT, a .NET implant, deploys via NEXLOAD downloader.
It XOR-decrypts payloads, runs them in memory via Donut tool, and disables AMSI/ETW. Plugins load via C&C.
| Packet Type | Function |
|---|---|
| plugin | Load .NET plugin |
| execplugin | Run plugin |
| Unloadplugin | Remove by ClientID/assembly |
| UnloadClientIDplugin | Remove by ClientID |
MKDOOR splits into downloader and backdoor modules. The downloader fetches payloads, adds itself to Defender exclusions, and mimics Microsoft URLs like /en-us/howtotell/default.aspx.
Backdoor uses /en-us/windows/activate-windows-c39005d4-95ee-b91e-b399-2820fda32227.
| Command | Description |
|---|---|
| INSTALL | Install module |
| UNINSTALL | Remove module |
| EXECUTE | Run module |
| SHOW | Status report |
| SLEEP | Pause (attacker-set time) |
| EXIT | Terminate |
| UNDATE | Undefined |
SHADOW-VOID-044 ties to UNC3569 via GRAYRABBIT overlaps, WizardNet/HOLODONUT links to TheWizard, and MKDOOR techniques matching Earth Lusca’s BIOPASS RAT. SHADOW-EARTH-045 hints at Earth Baxia via IP 47.238.184.9. Both show China-aligned APT coordination.
PeckBirdy’s JScript roots evade detection by dodging files and sandboxes. TrendAI Vision One™ spots IOCs, provides queries, and intel. Organizations should hunt LOLBin abuse, monitor script injections, and patch CVE-2020-16040.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
 framework called PeckBirdy since 2023){kind=link}