Researchers Trace PeckBirdy Infrastructure Through DNS and WHOIS Analysis

Mar 14, 2026 · Original article ↗

Summary

An investigation of PeckBirdy-related indicators analyzed DNS, WHOIS and threat-intelligence data, linking domains and IPs to phishing and malware activity and identifying additional infrastructure. The article attributes the framework to China-aligned APTs.

Key points

The article describes PeckBirdy as a JavaScript-based C2 framework used by China-aligned APT actors since 2023, with associated campaigns involving HOLODONUT, MKDOOR, stolen code-signing certificates, Cobalt Strike payloads and CVE-2020-16040.
Researchers analyzed 56 indicators, including domains, subdomains, IP addresses and WHOIS artifacts; they assessed all 28 initially identified domains as illegitimate.
DNS traffic data showed three client IP addresses queried an IoC domain 91 times between December 31, 2025, and January 29, 2026.
Historical data showed 22 IoC domains had 2,205 domain-to-IP resolutions; six domains were registered 122–804 days before being reported as malicious.
WHOIS history connected 35 email addresses to 21 IoC domains; follow-up analysis identified 64 additional email-connected domains.
Of 23 additional IP addresses found through current domain resolutions, threat-intelligence data classified 20 as previously weaponized for phishing or malware distribution.

Article Details

Attack Vectors: PeckBirdy is described as a JavaScript-based command-and-control framework used in campaigns since 2023; the article does not specify how it is executed on victim systems.
The reported campaigns also involved the modular backdoors HOLODONUT and MKDOOR, stolen code-signing certificates used to sign Cobalt Strike payloads, and exploitation of CVE-2020-16040.
The researchers reported that some identified domains and IP addresses were associated with malware distribution and phishing; the article does not establish that all were used in PeckBirdy campaigns.
Defensive Notes: The article recommends conducting supplementary investigations to corroborate entities identified as malicious, noting that their status may change or later be deemed harmless.
The reported indicators may support threat detection and response; the article does not provide specific remediation steps.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`a1icdn[.]com`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`githubgressaccess[.]info`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`img-cache[.]com`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`js-cdn[.]xyz`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`jsunpkg[.]com`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`microsoft-ads[.]com`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`mkdmcdn[.]com`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`ppcn-cdn[.]xyz`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`static-alicdn[.]com`	Listed as a domain IoC; the article reports that the 28 initially identified IoC domains were confirmed illegitimate.
DOMAIN	`update[.]myrnicrosoft[.]com`	Subdomain IoC that the article reports was involved in distributing malware.
DOMAIN	`updates[.]oss-cdn[.]com`	Subdomain IoC that the article reports was involved in distributing malware.
IPV4	`104[.]21[.]24[.]113`	The article identifies this IP as weaponized and associates it with malware distribution and phishing.
IPV4	`104[.]21[.]25[.]105`	The article identifies this IP as weaponized and associates it with phishing and malware distribution.
IPV4	`104[.]21[.]44[.]46`	The article identifies this IP as weaponized and associates it with phishing and malware distribution.
IPV4	`104[.]21[.]63[.]97`	The article identifies this IP as weaponized and associates it with phishing and malware distribution.
IPV4	`104[.]21[.]90[.]19`	The article identifies this IP as weaponized and associates it with phishing and malware distribution.
IPV4	`43[.]156[.]94[.]185`	Listed as an IP IoC in the article's DNS-resolution analysis.
IPV4	`8[.]218[.]50[.]207`	Listed as an IP IoC in the article's DNS-resolution analysis.
IPV4	`8[.]222[.]143[.]246`	Listed as an IP IoC in the article's DNS-resolution analysis.