Falcon C2 Framework Uses Malicious JavaScript and Browser Extensions to Compromise Government Targets in Middle East and Southeast Asia
Unit 42 uncovered Falcon (also known as XG or Xiàng Gē), a sophisticated command and control (C2) framework that compromises victims via malicious JavaScript running inside browsers and stealthy browser extensions masquerading as PDF viewers. Falcon operates entirely within the browser context, sideloading Chrome extensions to intercept credentials, cookies, browsing data, Discord and Zalo messages, Twitter/X direct messages, and clipboard content. An implant called Antino uses Microsoft OneDrive as a C2 channel delivered through Falcon. The observed campaigns targeted ministries of foreign affairs, defense, interior, and law enforcement in one Middle Eastern country and multiple Southeast Asian nations from March to May 2026, demonstrating tailored tradecraft such as JavaScript injections into webmail portals and social engineering to deliver malicious extensions. Falcon’s C2 infrastructure utilizes advanced OPSEC, including hidden login panels and encrypted WebSocket communications with a negotiated AES session key. The browser implant persists across sessions using local storage, cookies, and extension storage. Operators can hijack browsers as proxy servers to perform session hijacking and access internal resources. Palo Alto Networks offers multiple layers of detection and mitigation against Falcon’s techniques via URL filtering, DNS security, endpoint security, and identity management solutions. This framework represents an advanced, browser-focused espionage toolset tailored for strategic intelligence collection against government targets.
Linha do tempo
-
Falcon C2 Framework Uses Malicious JavaScript and Browser Extensions to Compromise Government Targets in Middle East and Southeast Asia
ler a análise desta fonte ocultar
Unit 42 uncovered Falcon (also known as XG or Xiàng Gē), a sophisticated command and control (C2) framework that compromises victims via malicious JavaScript running inside browsers and stealthy browser extensions masquerading as PDF viewers. Falcon operates entirely within the browser context, sideloading Chrome extensions to intercept credentials, cookies, browsing data, Discord and Zalo messages, Twitter/X direct messages, and clipboard content. An implant called Antino uses Microsoft OneDrive as a C2 channel delivered through Falcon. The observed campaigns targeted ministries of foreign affairs, defense, interior, and law enforcement in one Middle Eastern country and multiple Southeast Asian nations from March to May 2026, demonstrating tailored tradecraft such as JavaScript injections into webmail portals and social engineering to deliver malicious extensions. Falcon’s C2 infrastructure utilizes advanced OPSEC, including hidden login panels and encrypted WebSocket communications with a negotiated AES session key. The browser implant persists across sessions using local storage, cookies, and extension storage. Operators can hijack browsers as proxy servers to perform session hijacking and access internal resources. Palo Alto Networks offers multiple layers of detection and mitigation against Falcon’s techniques via URL filtering, DNS security, endpoint security, and identity management solutions. This framework represents an advanced, browser-focused espionage toolset tailored for strategic intelligence collection against government targets.