Loading malware…
PeckBirdy is a JScript-based command-and-control framework observed since 2023 in campaigns linked to China-aligned threat activity. It is designed for flexible execution across multiple environments, including web browsers, MSHTA, Windows Script Host, Classic ASP, Node.js, and .NET ScriptControl, and is notable for abusing living-off-the-land binaries and legacy scripting components to reduce reliance on conventional malware binaries. The framework has been used at multiple stages of intrusions, including watering-hole delivery, credential-harvesting operations, lateral movement, reverse-shell access, and backdoor command-and-control.
PeckBirdy uses environment detection to tailor execution to the host context and can retrieve environment-specific landing scripts from its server-side APIs. It generates victim identifiers, maintains session state, and primarily communicates over WebSocket, with fallback mechanisms for broader compatibility in constrained or legacy environments. Reported implementations include encrypted second-stage delivery and modular tasking, allowing operators to push follow-on scripts for functions such as cookie theft, social-engineering content, browser exploitation, Electron-based payload delivery, and TCP reverse shells.
Two major activity clusters have been associated with PeckBirdy. SHADOW-VOID-044 targeted the Chinese gambling sector through watering-hole compromises of gambling-related websites and used fake browser update lures to deliver modular backdoors including HOLODONUT and MKDOOR. SHADOW-EARTH-045, observed from 2024, targeted Asian government entities and private organizations, including credential-harvesting activity via injected content on government web pages and use of MSHTA-based execution for remote access and lateral movement inside compromised environments. Reporting has linked SHADOW-VOID-044 with moderate-to-high confidence to UNC3569 based on infrastructure and victimology overlap, while SHADOW-EARTH-045 has been linked with low confidence to Earth Baxia. Overall, PeckBirdy is best characterized as a versatile script-centric C2 framework supporting espionage-oriented intrusions and modular post-compromise operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The scripts we found included: The exploitation script for the CVE-2020-16040 vulnerability affecting Google Chrome | Since 2023, we have been observing threat campaigns employing a previously unseen script-based command-and-control (C&C) framework which we named PeckBirdy... PeckBirdy is a script-based framework... implemented using JScript... observed PeckBirdy in various kill chain stages, including being used as a watering-hole control server during the initial attack phase, as a reverse shell server during the lateral movement phase, and as a C&C server during the backdoor phase.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since 2023, we have been observing threat campaigns employing a previously unseen script-based command-and-control (C&C) framework which we named PeckBirdy... PeckBirdy is a script-based framework... implemented using JScript... observed PeckBirdy in various kill chain stages, including being used as a watering-hole control server during the initial attack phase, as a reverse shell server during the lateral movement phase, and as a C&C server during the backdoor phase.
Since 2023, we have been observing threat campaigns employing a previously unseen script-based command-and-control (C&C) framework which we named PeckBirdy... PeckBirdy is a script-based framework... implemented using JScript... observed PeckBirdy in various kill chain stages, including being used as a watering-hole control server during the initial attack phase, as a reverse shell server during the lateral movement phase, and as a C&C server during the backdoor phase.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Researchers have identified PeckBirdy, a versatile JScript-based C2 framework, deployed since 2023 in campaigns linked to China-aligned APT actors.
Researchers have tracked the versatile JScript-based command-and-control framework PeckBirdy since 2023, used by China-aligned threat actors in two distinct campaigns...
19 distinct techniques documented for this family, organized by ATT&CK tactic.
When victims visit these gambling websites, the injected scripts download and execute the main script of the PeckBirdy routine, allowing attackers to remotely deliver and execute JavaScript. | This flexibility allowed us to observe PeckBirdy in various kill chain stages, including being used as a watering-hole control server during the initial attack phase... Beginning in 2023, we noticed multiple Chinese gambling websites being injected with malicious scripts with links to remote servers.
"Delivered scripts observed include... TCP reverse shell establishment."
PeckBirdy is a script-based framework which, while possessing advanced capabilities, is implemented using JScript... allowing attackers to remotely deliver and execute JavaScript.
The subsequent communication is encrypted using AES and then encoded with Base64, with the AES encryption key being the ATTACK ID value from the configuration.
"execution through various living-off-the-land binaries (LOLBins)... such as browsers, MSHTA, WScript..."; "employing MSHTA for lateral movement"
...in another incident, we noticed the attacker using MSHTA to execute PeckBirdy as a remote access channel for lateral movement in a private organization.
Upon initial execution, PeckBirdy searches for unique objects that exist only in specific environments to determine the current execution context. It checks for the window object in browser environments, the process object in NodeJS environment, the response object in ASP environment, and the presence of the APPLICATION tag within the HTML in HTA environments.
We discovered that this campaign injects PeckBirdy links into government websites, likely to deliver scripts for credential harvesting on the website. In one case, the injection was on a login page of a government’s system...
In a local host environment such as HTA, it attempts to retrieve hardware information from the motherboard and hard drive on the victim’s machines. It then combines this information with MD5 to generate a hash value which serves as the victim ID.
Upon initial execution, PeckBirdy searches for unique objects that exist only in specific environments to determine the current execution context. It checks for the window object in browser environments, the process object in NodeJS environment, the response object in ASP environment, and the presence of the APPLICATION tag within the HTML in HTA environments.
The default method uses the WebSocket protocol to communicate with the PeckBirdy server... Using WebSocket in a browser as an example, PeckBirdy initially sends an init request to the remote server to initiate communication.
The PeckBirdy server has defined APIs, which allows clients to obtain landing scripts from the server via a simple HTTP(S) query... If neither of these methods are supported, PeckBirdy can use the Comet and LocalComet methods, which are based on HTTP(S) and AJAX protocols.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A script-based JScript command-and-control framework designed to run across multiple execution environments via LOLBins and other hosts such as browsers, MSHTA, WScript, Classic ASP, NodeJS, and .NET ScriptControl. It delivers second-stage scripts, supports WebSocket/Flash TCP/Comet communications, can steal cookies, deliver payloads, establish reverse shells, and support watering-hole, credential-harvesting, lateral movement, and backdoor operations.
JScript-based C2 framework used by China-aligned APT actors since 2023 to target multiple environments.
JScript-based C2 framework used for credential harvesting and malware delivery via web injection; supports multiple execution environments (e.g., mshta, WScript, ASP, Node.js, ScriptControl/.NET).
JScript-based command-and-control framework used in web-injection/credential-harvesting and malware-delivery campaigns, leveraging multiple Windows script execution environments (e.g., mshta, WScript, ASP, Node.js, ScriptControl).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.