Unit 42 says Falcon C2 compromised government sites via browser JavaScript
Original title: The XG Files: Falcon C2 Flying Under The (Browser) Radar
The framework stole credentials and cookies, sideloaded Chrome extensions, and delivered the Antino implant over OneDrive.
Palo Alto Networks Unit 42 describes Falcon, also called XG or Xiàng Gē, a NodeJS command-and-control framework that runs malicious JavaScript inside visitors' browsers. Attackers placed the script on webmail portals and government web applications, then stole passwords, emails, session cookies, and communications, sideloaded Chrome extensions, and delivered an implant called Antino that uses Microsoft OneDrive as its channel. Unit 42 says government entities in one Middle Eastern country and four Southeast Asian countries were compromised between March and May 2026, including foreign affairs, defense, interior, and law-enforcement bodies. It assesses with high confidence that Falcon and Trend Micro's PeckBirdy are variants of the same framework.
Unconfirmed: Unit 42's high-confidence claim that Falcon and PeckBirdy are the same core framework is its assessment.
- Management login stays hidden until F9 is pressed three times; listeners use TCP 8080 and 443.
- Default victim pages hosted JavaScript versions of Tetris or Snake.
- Session IDs use a Baidu-like Hm_lvt_ cookie and local-storage prefix.
- Falcon negotiates an AES session key encrypted with RSA; PeckBirdy uses a fixed AES key.
- Implants are built from victim_common.js and victim.js, then XOR-obfuscated per session.
Impact: Stolen passwords, emails, cookies, and communications from browser sessions
- Vendors
- Palo Alto NetworksMicrosoft
- Organizations
- Unit 42Trend Micro
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| url | https://{domain}/{ATTACK_ID} | PeckBirdy Description hxxps[:]//{domain}/config/{ATTACK_ID} hxxps[:]//{domain}/{ATTACK_ID} Standard payload hxxps[:]//{domain}/config/{ATTACK_ID}/ht |
| url | https://{domain}/{ATTACK_ID}/hta | Standard payload hxxps[:]//{domain}/config/{ATTACK_ID}/hta hxxps[:]//{domain}/{ATTACK_ID}/hta HTA application loader hxxps[:]//{domain}/config/{ATTACK_ |
| url | https://{domain}/{ATTACK_ID}/html | plication loader hxxps[:]//{domain}/config/{ATTACK_ID}/html hxxps[:]//{domain}/{ATTACK_ID}/html HTML loader hxxps[:]//{domain}/config/{ATTACK_ID}/wscript |
| url | https://{domain}/{ATTACK_ID}/wscript | l HTML loader hxxps[:]//{domain}/config/{ATTACK_ID}/wscript hxxps[:]//{domain}/{ATTACK_ID}/wscript JScript loader for HTA Table 1. URL structure comparison |
| url | https://{domain}/config/{ATTACK_ID} | uctures of the two frameworks. Falcon PeckBirdy Description hxxps[:]//{domain}/config/{ATTACK_ID} hxxps[:]//{domain}/{ATTACK_ID} Standard payload hxxps[:]/ |
| url | https://{domain}/config/{ATTACK_ID}/hta | {ATTACK_ID} hxxps[:]//{domain}/{ATTACK_ID} Standard payload hxxps[:]//{domain}/config/{ATTACK_ID}/hta hxxps[:]//{domain}/{ATTACK_ID}/hta HTA application loader |
| url | https://{domain}/config/{ATTACK_ID}/html | a hxxps[:]//{domain}/{ATTACK_ID}/hta HTA application loader hxxps[:]//{domain}/config/{ATTACK_ID}/html hxxps[:]//{domain}/{ATTACK_ID}/html HTML loader hxxps[:]/ |
| url | https://{domain}/config/{ATTACK_ID}/wscript | CK_ID}/html hxxps[:]//{domain}/{ATTACK_ID}/html HTML loader hxxps[:]//{domain}/config/{ATTACK_ID}/wscript hxxps[:]//{domain}/{ATTACK_ID}/wscript JScript loader for |
From the original article
13 min read at unit42.paloaltonetworks.com
We uncover Falcon C2, a browser-based threat framework targeting governments via malicious scripts, extensions, and the Antino implant. The post The XG Files: Falcon C2 Flying Under The (Browser) Radar appeared first on Unit 42.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.