TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Trend Micro Research

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

Joseph C Chen · 2026-01-26 · Read original ↗

ATT&CK techniques detected

12 predictions
T1204.002Malicious File
82%
“display fake software update webpages for google chrome to entice victims into downloading and executing malicious update files, which are backdoors prepared by the attackers. this constitutes the first campaign we identified, which we are tracking under the name shadow - void - …”
T1105Ingress Tool Transfer
78%
“deployed a customized simple downloader used to retrieve the payload from the remote server downloader that we tracked as nexload. the noteworthy feature of nexload is that it will send a string in a specific format, “ { string } # { string } ” during the first connection. next, …”
T1204.002Malicious File
73%
“only one we received was a short script for stealing the cookie values of injected websites on browsers. we also discovered additional script files hosted on one of peckbirdy ’ s server ( belonging to shadow - void - 044 ) which appear to be delivered and executed through peckbir…”
T1071.001Web Protocols
72%
“’ s machines. it then combines this information with md5 to generate a hash value which serves as the victim id. if this step fails or if it occurs in other environments that are unable to retrieve hardware information, it directly generates a 32 - character random string as a vi…”
T1204.002Malicious File
69%
“execution environments via lolbins ( living off the land binaries ). this flexibility allowed us to observe peckbirdy in various kill chain stages, including being used as a watering - hole control server during the initial attack phase, as a reverse shell server during the later…”
T1071.001Web Protocols
64%
“used by shadow - void - 044 connected to the same c & c server ( mkdmcdn [. ] com ), which is the same used by thewizard. while we didn ’ t see any additional connections between campaign alpha and thewizard, it ’ s worth noting that thewizard also used the darknimbus backdoor wh…”
T1059.001PowerShell
58%
“previously reported to be utilized by unc3569 ) was hosted on a server ( 47 [. ] 238 [. ] 219 [. ] 111 ) operated by this campaign. the grayrabbit sample we observed was slightly different, using a dll sideloading technique combined with the uuidfromstringa function of powershell…”
T1195.002Compromise Software Supply Chain
47%
“display fake software update webpages for google chrome to entice victims into downloading and executing malicious update files, which are backdoors prepared by the attackers. this constitutes the first campaign we identified, which we are tracking under the name shadow - void - …”
T1588.003Code Signing Certificates
41%
“used by shadow - void - 044 connected to the same c & c server ( mkdmcdn [. ] com ), which is the same used by thewizard. while we didn ’ t see any additional connections between campaign alpha and thewizard, it ’ s worth noting that thewizard also used the darknimbus backdoor wh…”
T1204User Execution
34%
“display fake software update webpages for google chrome to entice victims into downloading and executing malicious update files, which are backdoors prepared by the attackers. this constitutes the first campaign we identified, which we are tracking under the name shadow - void - …”
T1059Command and Scripting Interpreter
34%
“which includes the following items. table 2. the configuration embedded in the peckbirdy script to extend peckbirdy ’ s capability, its developer implemented it using an old script language known as jscript ( followed by ecmascript 3 ), and designed it to support multiple communi…”
T1189Drive-by Compromise
32%
“only one we received was a short script for stealing the cookie values of injected websites on browsers. we also discovered additional script files hosted on one of peckbirdy ’ s server ( belonging to shadow - void - 044 ) which appear to be delivered and executed through peckbir…”

Summary

PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities.