China-Linked Hackers Utilize PeckBirdy JavaScript C2 Framework Since 2023

The PeckBirdy framework has been actively used by China-aligned advanced persistent threat (APT) actors since 2023, targeting various environments, including Chinese gambling sites and Asian government organizations. Trend Micro researchers discovered the framework after observing malicious script injections on multiple gambling websites, which were designed to download and execute payloads that trick users into installing malware through fake Google Chrome updates.

This activity is categorized under two campaigns: SHADOW-VOID-044, which primarily targets gambling industries, and SHADOW-EARTH-045, which focuses on government entities, including a Philippine educational institution. In one instance, attackers injected scripts into a login page of a government system, while another case involved using MSHTA to execute PeckBirdy for lateral movement within a private organization.

PeckBirdy is notable for its flexibility, allowing it to operate across different execution environments such as web browsers, MSHTA, WScript, Classic ASP, Node JS, and .NET. Its server supports multiple APIs, enabling clients to retrieve landing scripts via HTTP(S) queries. The framework’s design allows it to evade traditional security measures by utilizing dynamically generated code and avoiding persistent file artifacts.

Once initiated, PeckBirdy communicates with its server using the WebSocket protocol, but can also fall back on Adobe Flash ActiveX objects or Comet. The server responds with second-stage scripts capable of stealing cookies and delivering additional malicious payloads. Among the scripts hosted on one of PeckBirdy’s servers are exploitation scripts for a Google Chrome vulnerability (CVE-2020-16040) and social engineering scripts designed to deceive users into downloading malicious files.

Further analysis revealed two modular backdoors associated with the framework: HOLODONUT and MKDOOR. HOLODONUT is a .NET-based backdoor launched via a downloader named NEXLOAD, while MKDOOR can load and uninstall various modules received from the server. These backdoors enhance the attack capabilities of the threat actors behind PeckBirdy.

Researchers suspect that the campaigns are linked to different China-aligned nation-state actors, based on shared infrastructure and techniques with other known threats. The presence of backdoors like GRAYRABBIT and similarities between MKDOOR and BIOPASS RAT suggest a coordinated effort among these actors.

The use of the PeckBirdy framework highlights the evolving tactics of cybercriminals, particularly in how they leverage living-off-the-land binaries to deliver modular backdoors. The dynamic nature of such JavaScript frameworks poses a significant challenge for detection and mitigation efforts.

• SHADOW-VOID-044: A campaign targeting Chinese gambling industries through script injections on websites.
• SHADOW-EARTH-045: A campaign focusing on Asian government entities, including a Philippine educational institution.
• HOLODONUT: A .NET-based modular backdoor launched using a downloader named NEXLOAD.
• MKDOOR: A modular backdoor capable of loading and uninstalling various modules received from the server.
• CVE-2020-16040: A Google Chrome vulnerability exploited by PeckBirdy scripts.