Stealth in Script: “PeckBirdy” Framework Powers New Wave of China-Aligned Attacks

PeckBirdy is a lightweight, JScript-based fileless command-and-control framework used by China-aligned APT actors since 2023 to target Asian government entities, the gambling industry, and educational institutions; it leverages Windows Script Host and runtime code injection to avoid persistent artifacts and detection, and is deployed with modular backdoors (HOLODONUT, MKDOOR) across campaigns that have used stolen code-signing certificates, Cobalt Strike, and exploited CVE-2020-16040.