Falcon C2 Browser-Based Framework Deploys Antino Implant Targeting Government Portals in Middle East and Southeast Asia
Between March and May 2026, a browser-based JavaScript command-and-control platform called Falcon C2 was used to hijack web browsers of government portals across a Middle Eastern country and four Southeast Asian nations. The threat injects malicious scripts into government web applications and Roundcube webmail headers, compromising agencies including ministries, police, military, and justice departments. The framework deploys rogue Chrome and Firefox extensions disguised as “PDF Viewer” which request broad permissions, and delivers a Rust backdoor named Antino that uses Microsoft OneDrive for command-and-control operations. Falcon C2 evades traditional endpoint detection by operating within the browser sandbox and uses advanced cryptographic handshakes and proxy techniques to execute commands and exfiltrate sensitive data including chat messages, emails, clipboard contents, and manual screenshots. Attribution points to variants related to the PeckBirdy framework, with indications of AI-assisted development.
Linha do tempo
-
Falcon C2 Browser-Based Framework Deploys Antino Implant Targeting Government Portals in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Between March and May 2026, a browser-based JavaScript command-and-control platform called Falcon C2 was used to hijack web browsers of government portals across a Middle Eastern country and four Southeast Asian nations. The threat injects malicious scripts into government web applications and Roundcube webmail headers, compromising agencies including ministries, police, military, and justice departments. The framework deploys rogue Chrome and Firefox extensions disguised as “PDF Viewer” which request broad permissions, and delivers a Rust backdoor named Antino that uses Microsoft OneDrive for command-and-control operations. Falcon C2 evades traditional endpoint detection by operating within the browser sandbox and uses advanced cryptographic handshakes and proxy techniques to execute commands and exfiltrate sensitive data including chat messages, emails, clipboard contents, and manual screenshots. Attribution points to variants related to the PeckBirdy framework, with indications of AI-assisted development.