PeckBirdy
PeckBirdy is a JScript-based command-and-control framework observed since 2023 in campaigns linked to China-aligned threat actors. It is designed for flexible deployment across multiple execution environments, including browsers, MSHTA, WScript, Classic ASP, Node.js, and .NET ScriptControl, and abuses living-off-the-land binaries to operate in diverse contexts. The framework performs environment detection to adapt behavior, generates victim identifiers, and communicates primarily over WebSocket, with fallbacks including Flash ActiveX TCP sockets and HTTP/AJAX-based Comet or LocalComet. Reported communications are AES-encrypted and Base64-encoded, using a predefined 32-character ATTACK_ID as the key.
PeckBirdy has been associated with two tracked campaigns: SHADOW-VOID-044 and SHADOW-EARTH-045. SHADOW-VOID-044, active since 2023, targeted Chinese gambling websites and the broader Chinese gambling industry through script injection and fake Google Chrome update lures that delivered malware. Infrastructure tied to this activity also hosted second-stage content including social-engineering pop-ups, reverse shell functionality, Electron-delivered backdoors, and a script exploiting Google Chrome vulnerability CVE-2020-16040. SHADOW-EARTH-045, observed from July 2024, targeted Asian government entities and private organizations, including a Philippine educational institution, and used injected website content for likely credential harvesting. In one reported case, attackers used MSHTA to launch PeckBirdy on a compromised IIS server; the activity also involved compromised GitHub infrastructure.
The framework has been used to deliver modular backdoors including HOLODONUT and MKDOOR. HOLODONUT is described as a .NET modular backdoor delivered via NEXLOAD, with AMSI/ETW evasion and Donut-based in-memory execution. MKDOOR is described as a modular or two-module backdoor system whose downloader adds Microsoft Defender exclusions and disguises traffic as legitimate Microsoft support or activation traffic. Additional malware and tooling observed in related infrastructure include GRAYRABBIT and Cobalt Strike.
Attribution in the reporting links PeckBirdy activity to multiple China-aligned clusters with varying confidence. SHADOW-VOID-044 was assessed with moderate-to-high confidence as linked to UNC3569 based on shared C2 infrastructure, overlapping victimology, and GRAYRABBIT usage. Reporting also noted HOLODONUT infrastructure overlap with activity associated with TheWizard, and low-confidence links between SHADOW-EARTH-045 and Earth Baxia. Reported targets include the gambling industry, Asian government entities, private organizations, and a Philippine educational institution. Detection is described as difficult because PeckBirdy relies on dynamically generated, runtime-injected JavaScript and often leaves limited persistent file artifacts.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Researchers have tracked the versatile JScript-based command-and-control framework PeckBirdy since 2023, used by China-aligned threat actors in two distinct campaigns...
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"In watering-hole scenarios, malicious scripts injected into websites trigger downloads of the main PeckBirdy script upon victim visitation, often leading to fake software update pages that prompt execution of malicious files." | "malicious scripts injected into websites trigger downloads of the main PeckBirdy script upon victim visitation"
Execution
4 techniques"Delivered scripts observed include... TCP reverse shell establishment."
"...compromised Chinese gambling websites through script injection, redirecting victims to fake Google Chrome update pages..."
"Delivered scripts observed include CVE-2020-16040 exploitation for Chrome"
"...redirecting victims to fake Google Chrome update pages that delivered malicious backdoors." and "...social engineering techniques to deceive users into executing malware."
Stealth
2 techniques"execution through various living-off-the-land binaries (LOLBins)... such as browsers, MSHTA, WScript..."; "employing MSHTA for lateral movement"
"The threat actor executed an MSHTA command connecting to github[.]githubassets[.]net to launch PeckBirdy on a compromised Internet Information Services (IIS) server."
Credential Access
1 techniqueCollection
1 techniqueCommand and Control
3 techniques"...PeckBirdy JavaScript C2 Framework"; "VoidLink... modular framework"; "DKnife AitM framework... implants..."
"The threat actor also simultaneously downloaded files from 47[.]238[.]184[.]9..."
"responses deliver second-stage scripts with AES-encrypted and Base64-encoded payloads"
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JScript-based C2 framework used by China-aligned APT actors since 2023 to target multiple environments.
JScript-based C2 framework used for credential harvesting and malware delivery via web injection; supports multiple execution environments (e.g., mshta, WScript, ASP, Node.js, ScriptControl/.NET).
JScript-based command-and-control framework used in web-injection/credential-harvesting and malware-delivery campaigns, leveraging multiple Windows script execution environments (e.g., mshta, WScript, ASP, Node.js, ScriptControl).
JScript-based C2 framework used by China-aligned actors to manage infections and deliver additional backdoors, including via fake update lures and exploit chains.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.