China-Aligned APTs Use PeckBirdy C&C in Multi-Vector Attacks with Stolen Certificates

A sophisticated JScript-based command-and-control framework called PeckBirdy has been actively used by China-aligned advanced persistent threat (APT) actors since 2023, targeting Chinese gambling industries, Asian government entities, and private organizations.

Security researchers have linked the framework to multiple coordinated campaigns that leverage stolen code-signing certificates and exploit known vulnerabilities to maintain persistent access across victim networks.

PeckBirdy is a script-based C&C framework implemented using JScript, an older script language designed to ensure compatibility across multiple execution environments.

This design choice allows attackers to launch PeckBirdy through Living off the Land Binaries (LOLBins), making detection more difficult and providing flexibility across different attack stages.

The framework can execute in various environments, including browsers, MSHTA, WScript, Classic ASP, Node JS, and .NET ScriptControl.

Depending on the environment, PeckBirdy’s capabilities and purposes vary from operating as a watering-hole control server during initial attacks to functioning as a reverse shell server during lateral movement and as a full C&C server during the backdoor phase.

PeckBirdy supports multiple communication protocols including WebSocket, TCP sockets via Adobe Flash ActiveX objects, and HTTP(S)-based Comet and LocalComet methods.

This multi-protocol approach ensures broad compatibility across different environments, with the framework automatically detecting and selecting the most suitable communication method available.

Two Coordinated Attack Campaigns

Security researchers identified two distinct campaigns utilizing PeckBirdy, tracked as SHADOW-VOID-044 and SHADOW-EARTH-045.

The SHADOW-VOID-044 campaign primarily targeted Chinese gambling websites beginning in 2023. Attackers injected malicious scripts into these websites that downloaded and executed PeckBirdy’s main script when victims visited.

The framework then displayed fake Google Chrome update pages, tricking users into downloading and executing backdoors disguised as legitimate software updates.

The SHADOW-EARTH-045 campaign, observed in July 2024, focused on Asian government entities and private organizations.

A Cobalt Strike sample was signed using a certificate stolen from a South Korean gaming company, demonstrating the threat actors’ access to legitimate digital signatures.

Attackers injected PeckBirdy links into government websites, likely to harvest credentials on login pages. In one incident, researchers observed attackers using MSHTA to execute PeckBirdy as a remote access channel for lateral movement within a private organization.

One campaign leveraged stolen code-signing certificates and Cobalt Strike payloads to evade detection.

To extend PeckBirdy’s capability, its developer implemented it using an old script language known as JScript (followed by ECMAScript 3), and designed it to support multiple communication protocols.

The campaigns also exploited CVE-2020-16040, a Google Chrome vulnerability, and maintained infrastructure across multiple C&C domains and IP addresses.

HOLODONUT and MKDOOR

Researchers discovered two modular backdoors linked to SHADOW-VOID-044: HOLODONUT and MKDOOR. HOLODONUT is a .NET-based modular backdoor that uses multiple defense evasion techniques, including disabling AMSI and EtwEvent, and employing the open-source Donut tool to execute .NET assemblies stealthily in process memory.

The backdoor features a plugin handler that can receive, execute, and unload plugins from C&C servers.

MKDOOR is another modularly-designed backdoor composed of a downloader and backdoor module. The malware attempts to bypass Microsoft Defender by adding itself to the exclusion list and disguises its C&C URLs as Microsoft support and Windows activation pages.

MKDOOR supports commands for installing, uninstalling, and executing modules, with capabilities depending on modules received from the C&C server.

Based on victimology and tactics, techniques, and procedures (TTPs), researchers attributed SHADOW-VOID-044 to UNC3569 with moderate to high confidence.

Evidence includes the GRAYRABBIT backdoor hosted on campaign infrastructure and shared targeting of the Chinese gambling industry.

HOLODONUT samples also connected to infrastructure used by TheWizard APT group, suggesting potential collaboration or tool sharing among China-aligned threat actors.

SHADOW-EARTH-045 showed potential links to Earth Baxia, though attribution remains low confidence.

Trend Micro’s Vision One platform detects and blocks indicators of compromise associated with these campaigns, providing customers with threat hunting queries and intelligence reports.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.