Trend Micro detailed PeckBirdy, a JScript-based C2 framework used by China-aligned APT groups to target gambling industries and Asian governments through Living-off-the-Land Binaries. The framework executes across multiple environments including browsers, MSHTA, and WScript, deploying modular backdoors like HOLODONUT and MKDOOR. Defense evasion techniques include AMSI/ETW disabling and manipulating Microsoft Defender exclusion lists, because why fight the antivirus when you can just politely ask it to look the other way? Trend Micro also found the same PeckBirdy domain and IP address in Kaspersky’s July 2025 report on APT41 attacking government IT services in Africa, where mshta fetched an HTA whose JavaScript reverse shell reached its C2 over WebSockets, AJAX or Flash, the same transports PeckBirdy relies on.
