Probing the DNS Depths of PeckBirdy

Trend Micro recently reported on PeckBirdy, a JavaScript-based command-and-control (C&C) framework used by China-aligned APT actors since 2023. Designed to operate across multiple environments, PeckBirdy enables flexible deployment and has been linked to campaigns involving modular backdoors such as HOLODONUT and MKDOOR, along with Cobalt Strike payloads, stolen code-signing certificates, and exploitation of CVE-2020-16040.

The researchers identified 36 network IoCs¹ tied to the activity. After extracting unique domains from the subdomains flagged as IoCs, we analyzed 56 IoCs in total. Using our homegrown tools to investigate the threat, we uncovered these findings:

• Three unique client IP addresses communicated with one domain classified as an IoC
• Six domains identified as IoCs were registered with malicious intent 122–804 days before being dubbed as such
• 64 email-connected domains
• 23 additional IP addresses, 20 of which turned out to be malicious
• Two IP-connected domains
• 18,188 string-connected domains, 49 of which turned out to be malicious

Before conducting our in-depth IoC investigation, we also assessed the legitimacy of the 28 domains identified as IoCs using the WhoisXML API MCP Server², confirming that all were illegitimate.

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.trendmicro.com/en_us/research/26/a/peckbirdy-script-framework.html
• [2] https://main.whoisxmlapi.com/ai/mcp-server