Trendmicro

PeckBirdy Framework Targets Gambling Industries in China

First seen 27 Jan 2026, 04:47 UTC • Feeds.Trendmicro

•95% similarity •24.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

PeckBirdy is a JScript-based command-and-control framework utilized by China-aligned APT groups to exploit LOLBins. Since 2023, it has been deployed against gambling industries and Asian government entities, delivering advanced backdoors to these targets.

ThreatCluster AI

Attack Flow

28 entities, 46 inferred relationships (STIX 2.1).

Threat Actor (1)

Unc3569

Technique (8)

Malware
Phishing
T1059.001 - PowerShell
T1059.005 - Windows Script
T1059.005 - Windows Script Host
T1189 - Drive-by Compromise
T1218.005 - Mshta
T1566 - Phishing

Campaign (2)

Shadow-earth-045
Shadow-void-044

Malware (6)

Grayrabbit
Holodonut
Mkdoor
Nexload
PeckBirdy
WizardNet

Affected Platform (4)

Classic ASP
HTA
Node JS
Windows

Indicator (2)

162cc325ab7b6e70edb6f4d0bc0e52130c56903f
bbd2b9b87f968ed88210d4261a1fe30711e8365b

Tool (5)

Google Chrome
Donut
Mshta
PowerShell
WScript

Relationships

Unc3569 uses Grayrabbit
Unc3569 uses Holodonut
Unc3569 uses Mkdoor
Unc3569 uses Nexload
Unc3569 uses PeckBirdy
Unc3569 uses Google Chrome
Unc3569 uses Donut
Unc3569 uses Mshta
Unc3569 uses PowerShell
Unc3569 uses WScript
Unc3569 uses Malware
Unc3569 uses Phishing
Unc3569 uses T1059.001 - PowerShell
Unc3569 uses T1059.005 - Windows Script
Unc3569 uses T1059.005 - Windows Script Host
Grayrabbit communicates with 162cc325ab7b6e70edb6f4d0bc0e52130c56903f
Grayrabbit communicates with bbd2b9b87f968ed88210d4261a1fe30711e8365b
Holodonut communicates with 162cc325ab7b6e70edb6f4d0bc0e52130c56903f
Holodonut communicates with bbd2b9b87f968ed88210d4261a1fe30711e8365b
Mkdoor communicates with 162cc325ab7b6e70edb6f4d0bc0e52130c56903f
Mkdoor communicates with bbd2b9b87f968ed88210d4261a1fe30711e8365b
Nexload communicates with 162cc325ab7b6e70edb6f4d0bc0e52130c56903f
Nexload communicates with bbd2b9b87f968ed88210d4261a1fe30711e8365b
PeckBirdy communicates with 162cc325ab7b6e70edb6f4d0bc0e52130c56903f
PeckBirdy communicates with bbd2b9b87f968ed88210d4261a1fe30711e8365b
WizardNet communicates with 162cc325ab7b6e70edb6f4d0bc0e52130c56903f
WizardNet communicates with bbd2b9b87f968ed88210d4261a1fe30711e8365b
Shadow-earth-045 attributed to Unc3569
Shadow-void-044 attributed to Unc3569
Shadow-earth-045 uses Grayrabbit
Shadow-earth-045 uses Holodonut
Shadow-earth-045 uses Mkdoor
Shadow-earth-045 uses Nexload
Shadow-earth-045 uses PeckBirdy
Shadow-void-044 uses Grayrabbit
Shadow-void-044 uses Holodonut
Shadow-void-044 uses Mkdoor
Shadow-void-044 uses Nexload
Shadow-void-044 uses PeckBirdy
Unc3569 related to T1189 - Drive-by Compromise
Unc3569 related to T1218.005 - Mshta
Unc3569 related to T1566 - Phishing
Unc3569 related to Classic ASP
Unc3569 related to HTA
Unc3569 related to Node JS
Unc3569 related to Windows

Community

Browse all →

Tracked Entities in This Story

Unc3569 Grayrabbit Holodonut Mkdoor Nexload PeckBirdy WizardNet Shadow-earth-045 Shadow-void-044 Classic ASP HTA Node JS Windows Gambling Government Malware Phishing Google Chrome

PeckBirdy Framework Targets Gambling Industries in China

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story