PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups

This report analyzes a versatile JScript-based command-and-control framework named PeckBirdy used since 2023 in at least two campaigns (SHADOW-VOID-044 and SHADOW-EARTH-045) targeting Chinese gambling sites and Asian government/private organizations; it describes delivery via website injections and LOLBins, detailed C2 protocols and configs, two modular backdoors (HOLODONUT and MKDOOR), associated tooling (NEXLOAD, Donut, Cobalt Strike), observed TTPs for credential theft and lateral movement, and attribution links to multiple China-aligned APTs.