SHADOW-VOID-044

SHADOW-VOID-044 is a temporary intrusion set associated with use of the PeckBirdy JScript-based command-and-control framework in campaigns observed since 2023. The cluster is linked with moderate-to-high confidence to UNC3569 and is assessed as China-aligned based on overlapping infrastructure and victimology. Its activity has centered on compromises of Chinese gambling websites, where malicious script injections were used as watering-hole mechanisms to load PeckBirdy in victims’ browsers and present fake Google Chrome update lures that delivered attacker-prepared backdoors. The intrusion set has used PeckBirdy as a flexible, cross-environment framework capable of operating through browsers and Windows scripting components, enabling staged payload delivery and follow-on access. Infrastructure associated with SHADOW-VOID-044 also hosted scripts for cookie theft, reverse shells, social-engineering delivery, and exploitation of CVE-2020-16040. Reported malware linked to the cluster includes MKDOOR, HOLODONUT, GRAYRABBIT, NEXLOAD, and Cobalt Strike. HOLODONUT is a modular .NET backdoor delivered by the NEXLOAD downloader, while MKDOOR is another modular backdoor delivered through fake browser-update phishing pages. Observed tradecraft includes watering-hole compromise, social-engineering-based malware delivery, credential- and session-related theft through browser cookie collection, in-memory execution of .NET payloads, AMSI and event-tracing suppression, and Microsoft Defender exclusion abuse for evasion. Additional execution techniques reported in the cluster include DLL sideloading and PowerShell-based payload decoding and execution. The actor’s tooling and infrastructure overlap with other China-linked clusters illustrates the broader ecosystem of shared malware, certificates, and operational resources among Chinese intrusion activity.