PeckBirdyMalware
According to Trend Micro, PeckBirdy is a script-based framework which, while possessing advanced capabilities, is implemented using JScript, an old script language. This is to ensure that the framework could be launched across different execution environments via LOLBins (Living off the land binaries).From MISP Galaxy
Last reported 1 month ago, by The Register (security)2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1553.002Code Signing
“One of campaigns leverage stolen code-signing certificates Cobalt Strike payloads, and exploits (CVE-2020-16040) hosted across multiple C&C domains and IP addresses to maintain persistent access.”
- T1684Social Engineering
“Scripts for social engineering pop-ups designed to deceive victims into downloading and executing malicious files.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Low-quality casino sites conceal highly dangerous threat actors“"China-aligned APT groups have been running the PeckBirdy framework since 2023, hiding their malware C2 domains inside low-quality Chinese-language casino websites," Infoblox said.”
-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups”
Indicators in its reports
named in the reports above- 47.238.219[.]111in 1 report
- center.myrnicrosoft[.]comin 1 report
- mkdmcdn[.]comin 1 report
- 162cc325ab7b6e70…52130c56903fin 1 report
- oss-cdn[.]comin 1 report
- bbd2b9b87f968ed8…e30711e8365bin 1 report
- github.githubassets[.]netin 1 report
- 47.238.184[.]9in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.