Cybersecurity researchers have discovered PeckBirdy, a modular command-and-control (C2) framework built using JScript. The framework has been used by Chinese advanced persistent threat (APT) groups since at least 2023. It has been seen targeting online gambling sites in China and government and private organizations throughout Asia.

Background and Discovery

Security firm Trend Micro first identified PeckBirdy in 2023 after finding malicious script injections on several Chinese gambling websites. These injected scripts downloaded and ran additional JavaScript code, allowing attackers to execute remote commands and deliver more malware.

The framework uses JScript—an older scripting language—to work across many different Windows environments. This choice lets attackers use legitimate Windows tools (called living-off-the-land binaries or LOLBins), making it easier to run their code in places where newer tools might be blocked or watched.

Initial Infection and Social Engineering

Early attacks focused on redirecting victims to fake Google Chrome update pages. These phony update prompts tricked users into downloading and running malicious installers, leading to system compromise. This activity is tracked as SHADOW-VOID-044.

Observed Campaigns

Researchers have found two separate attack campaigns using PeckBirdy:

  • SHADOW-VOID-044 This campaign mainly targeted Chinese gambling sites, using website injections and fake software updates to deliver malware.
  • SHADOW-EARTH-045 First seen in July 2024, this campaign went after Asian government agencies and private organizations, including at least one educational institution in the Philippines. Attackers injected PeckBirdy-related links directly into legitimate government websites, likely to steal login credentials.

In one case, the malicious script appeared on a government login page. In another, attackers used MSHTA to run PeckBirdy and move laterally through a private organization’s network. The threat actors also deployed a custom .NET loader that launches PeckBirdy through ScriptControl, showing how flexible the framework is.

Framework Capabilities and Architecture

PeckBirdy stands out because it can run in many different environments, including:

  • Web browsers
  • MSHTA
  • WScript
  • Classic ASP
  • Node.js
  • .NET (through ScriptControl)

The backend infrastructure provides multiple HTTP(S) APIs that deliver environment-specific “landing scripts” to infected systems. Each request includes a predefined 32-character ATTACK ID, which tells the server which script version to send back.

Once running, PeckBirdy identifies what environment it’s in, creates a unique identifier for the victim, and saves it for future connections. The framework then checks which communication methods are available. While WebSocket is preferred, it can fall back to Adobe Flash ActiveX objects or Comet-style polling if needed.

Second-Stage Payloads and Post-Exploitation

After connecting to the C2 server—sending both the ATTACK ID and victim ID—the server sends back a second-stage script. Some of these scripts steal browser cookies, while others enable deeper compromise of the system.

Infrastructure linked to SHADOW-VOID-044 has been found hosting additional malicious tools, including:

  • An exploit for a patched Google Chrome V8 vulnerability (CVE-2020-16040)
  • Social-engineering scripts that show fake pop-ups to trick users into downloading malware
  • Electron-based backdoors
  • Reverse shell tools that communicate over raw TCP connections

Analysis also revealed two modular backdoors delivered through this system:

  • HOLODONUT – A .NET backdoor launched by a small downloader called NEXLOAD, which can load, run, or remove plugins sent by the C2 server.
  • MKDOOR – A modular backdoor with similar features, supporting dynamic module management.

Attribution Assessment

While researchers can’t definitively say who’s behind these attacks, they believe SHADOW-VOID-044 and SHADOW-EARTH-045 may be linked to different Chinese nation-state groups. This assessment is based on several technical connections, including:

  • The presence of GRAYRABBIT, a backdoor previously linked to UNC3569, on SHADOW-VOID-044 infrastructure
  • Code and functional similarities between HOLODONUT and WizardNet, a backdoor attributed to a group called TheWizards
  • A Cobalt Strike file hosted on SHADOW-VOID-044 servers that was signed with a certificate used in a 2021 BIOPASS RAT campaign against Chinese gambling companies
  • Behavioral similarities between MKDOOR and BIOPASS RAT, both of which create an HTTP listener on a high-numbered local port
  • SHADOW-EARTH-045’s use of infrastructure previously connected to Earth Baxia and APT41

Defensive Implications

AI used to code a malwareTrend Micro notes that these campaigns show how flexible, script-based frameworks like PeckBirdy can effectively abuse legitimate system tools to avoid detection. Because the framework relies heavily on code generated at runtime and leaves very few persistent files on disk, traditional security software may have difficulty identifying or blocking this activity. Detecting malicious JavaScript-based C2 frameworks remains a major challenge for defenders, especially in environments where scripting tools and LOLBins are widely used.

References: