Trend Micro Details PeckBirdy JScript C2 Framework Used in China-Aligned Intrusions

Trend Micro reported on PeckBirdy, a lightweight JScript-based command-and-control (C2) framework used since at least 2023 by China-aligned threat actors to reduce on-disk artifacts and evade detection by leveraging Windows Script Host and runtime-injected code. The activity was tied to two intrusion sets/campaigns, SHADOW-VOID-044 and SHADOW-EARTH-045, with victimology including Asian government entities, education, and the Chinese gambling sector. The framework was observed operating alongside modular backdoors HOLODONUT and MKDOOR, and in at least one campaign with commodity tooling such as Cobalt Strike and the use of stolen code-signing certificates.

Trend Micro’s analysis linked SHADOW-VOID-044 infrastructure and tooling to previously reported China-aligned activity, including overlap with UNC3569 (e.g., shared C2 domain center[.]myrnicrosoft[.]com and targeting of the Chinese gambling industry) and hosting of a variant of the GRAYRABBIT backdoor that used DLL sideloading and PowerShell execution via UuidFromStringA. Additional infrastructure overlaps were noted with activity associated with TheWizard (e.g., HOLODONUT samples communicating with mkdmcdn[.]com). Reported infrastructure and artifacts included IP 47[.]238[.]219[.]111, domains center[.]myrnicrosoft[.]com, mkdmcdn[.]com, and a Cobalt Strike payload with SHA-256 162cc325ab7b6e70edb6f4d0bc0e52130c56903f.