Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5779 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Falcon/Antino Fake Flash Update Delivery — Domain Lookup and Installer Execution (Exploitation)

Detects the delivery stage of the Falcon (XG) browser C2 campaign that pushes the Rust Antino implant: Sysmon DNS lookups of microsoft-flash.com, wps-cn.com and osc-cdn.com (also used by UAT-11587), and execution of the fake Adobe Flash installers Adobe_installer.exe / flashcenter_pp_ax_install_en.exe. Observed against a Southeast Asian police entity in May 2026.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036, T1583.001
• Data sources: sysmon:EventCode=22 (DNS query), sysmon:EventCode=1 (process create), index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h (EventCode=22 OR EventCode=1)
| eval dns_hit=if(EventCode=22 AND match(lower(QueryName), "(^|\.)(microsoft-flash\.com|wps-cn\.com|osc-cdn\.com)$"), 1, 0)
| eval exec_hit=if(EventCode=1 AND (match(lower(Image), "(adobe_installer|flashcenter_pp_ax_install_en)\.exe$") OR match(lower(CommandLine), "microsoft-flash\.com|wps-cn\.com|adobe_installer\.exe")), 1, 0)
| where dns_hit=1 OR exec_hit=1
| eval detection=case(dns_hit=1, "dns_to_antino_delivery_domain", exec_hit=1, "fake_flash_installer_execution")
| stats count min(_time) as first_seen max(_time) as last_seen values(QueryName) as queried_domains values(Image) as images values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, detection
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let DeliveryDomains = dynamic(["microsoft-flash.com", "wps-cn.com", "osc-cdn.com"]);
let NetHits = DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (DeliveryDomains) or RemoteIP == "103.27.110.220"
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, Detail = RemoteUrl, SourceTable = "DeviceNetworkEvents";
let ExecHits = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("Adobe_installer.exe", "flashcenter_pp_ax_install_en.exe")
        or SHA256 == "0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd"
        or ProcessCommandLine has_any (DeliveryDomains)
    | project Timestamp, DeviceName, AccountName, FileName, Detail = ProcessCommandLine, SourceTable = "DeviceProcessEvents";
union NetHits, ExecHits
| order by Timestamp desc

Sigma

title: Falcon/Antino Fake Flash Update Delivery Domain DNS Query
id: 6f1c2a10-5779-4a01-9b11-0a1d5f3c7e01
status: experimental
description: Detects DNS resolution of microsoft-flash.com, wps-cn.com or osc-cdn.com, domains used by the Falcon (XG) fake Adobe Flash update lure and UAT-11587 delivery of the Antino implant.
references:
    - https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/
    - https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.resource_development
    - attack.t1583.001
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036
    - attack.tool.falcon_xg
    - attack.tool.antino
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'microsoft-flash.com'
            - 'wps-cn.com'
            - 'osc-cdn.com'
    condition: selection
falsepositives:
    - Security researchers or threat-intel sandboxes resolving the domains
    - Sinkholed or blocked lookups by DNS security tooling
level: high

Known false positives:

• Threat-intel analysts or sandboxes deliberately resolving these domains
• Legitimate software named Adobe_installer.exe from an unrelated vendor (verify hash and download origin)

Tuning notes: Requires Sysmon event 22 (DNS) and 1 (process create) in index=sysmon; change index/sourcetype to match your Sysmon input. Exclude hosts of your own malware-analysis lab. The Adobe_installer.exe name alone is weak, so pair hits with the delivery domain or the Antino SHA-256 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd.

• 🔒 Falcon Malicious 'PDF Viewer' Browser Extension Sideload (Exploitation/Persistence) · unlock with TL Creds
• 🔒 Antino Self-Copy Staging and [indicator] Sideload (Post-Exploitation) · unlock with TL Creds
• 🔒 Falcon (XG) Browser C2 Domain and Infrastructure Contact (C2) · unlock with TL Creds
• 🔒 Falcon (XG) Injected Script Loader URL Pattern and Roundcube Config Resource (Exploitation) · unlock with TL Creds
• 🔒 Falcon Malicious Extension Files in Browser Profile (Post-Exploitation Collection) · unlock with TL Creds
• 🔒 Antino OneDrive C2 Heartbeat and Command File Traffic (C2) · unlock with TL Creds
• 🔒 Antino sdiagnhost.exe Proxy Execution and Run Key Persistence (Post-Exploitation) · unlock with TL Creds
• 🔒 Antino OneDrive C2 Beaconing from Unusual Process (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-5779.

Sample indicators (3 of 27)

• IP address: 103.27.110[.]220
• Domain: fonts[.]tarotfree101[.]top
• File hash: 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Technical analysis

Falcon (also called XG, from Xiàng Gē) is a C2 framework whose server is written in Node.js and exposes two listeners: a management panel on TCP 8080 and a victim-facing listener on TCP 443. The panel renders a blank page and only reveals a login form after the F9 key is pressed three times consecutively; right-click is disabled, and the victim-facing listener serves a JavaScript Tetris/Snake game as a decoy. Unit 42 assesses with high confidence that Falcon is a variant of the PeckBirdy script framework reported by Trend Micro in January 2026: both share near-identical URL structures (Falcon adds a /config/ prefix), the same HTA/HTML/JScript loader payload sequence, AES encryption, and Baidu-style 'Hm_lvt_' session identifiers. Unit 42 also assesses the code was likely developed with AI assistance (coding style, naming, comments, inconsistent design). The operator is not named by Unit 42.

Delivery observed by Unit 42 took three forms. (1) In April 2026 a script tag was injected into the header of a Middle Eastern Ministry of Foreign Affairs Roundcube webmail portal, loading an obfuscated implant from a config resource (config_r5lfmqe3) and intercepting credentials and sessions; 39 affected instances were identified, all in the target country. (2) In May 2026 a Southeast Asian police entity's web application was hit with a custom Falcon module that harvested the logged-in username (leftusername element, reported via xg_note) and displayed a fake Adobe Flash update prompt to hard-coded users fewer than 10 times (popup_count), leading to download of Adobe_installer.exe from microsoft-flash[.]com — the Antino implant. (3) In a Southeast Asian justice entity, a sideloaded Chrome extension disguised as a PDF viewer checked in every 3-4 minutes for more than three weeks, captured a full-page screenshot of a sensitive document, exfiltrated credentials, and logged 20+ routing-slip views between late April and mid-May 2026. Separate Falcon campaigns also hit a Southeast Asian military entity and a Southeast Asian Ministry of Foreign Affairs; Unit 42 does not explain how the extension is deployed (possibly via social engineering with a silent-install utility, firefox.zip / browser.exe uploaded to the panel on 2026-04-23 and 2026-04-25).

The per-session implant is built from victim_common.js and victim.js, XOR-encoded into an integer array with a small decoder, and tracked with a 32-character session ID stored in local storage key 'Hm_lvt_$', a cookie 'Hm_lvt__<session ID>=1' (expiry 2099) and extension storage. It holds a TLS WebSocket open with a one-minute {"heartbeat":"1"} message, negotiates a 2048-bit RSA key exchange for an AES-256-CBC session key/IV, and supports 'run' (arbitrary JavaScript via eval) and 'set_remark' commands, with an unencrypted 'Comet' fallback. Custom-module APIs include xg_note, xg_send, xg_data and xg_notify (Telegram notification).

The malicious extension (ID mbidcmlcbgbphpoacojjbmfpohcimjji, Manifest V3, v2026.5.13.1, 40 permissions and <all_urls>) provides a victim-browser web proxy using the victim's cookies, download interception/replacement (e.g. ChromeSetup.exe), network hooking of fetch/XHR (up to 500 cached responses), clipboard hijacking with replacement rules (account numbers, crypto wallet addresses), Gmail mailbox theft via the session cookie, Discord and Zalo chat capture, X/Twitter DM scraping, and collection of passwords/autofill (last 500), cookies, browsing and download history.

Antino is a Rust implant (earliest known sample compiled 2025-10-06) with an XOR-encoded (key 0xABCD) .cfg PE-section configuration containing OneDrive tenant_id, client_id, client_secret and user_id. It copies itself to %LOCALAPPDATA%\Windows GatherOSStateKit\tmp<8 chars>.exe, writes %TEMP%\SDIAG_<GUID>\result\result.ps1 and runs sdiagnhost.exe to execute PowerShell and add a Registry Run key. C2 is via OneDrive: heartbeat JSON to antino/heartbeat/<Bot ID>.json, polling for command_req_<Bot ID>_<timestamp>.json, and ten commands (cmd, ps, system_info, list_files, add_to_run, exit, load [Rhai script], execute_program, upload_file, download_file). Cisco Talos separately tracks Antino use by China-nexus cluster UAT-11587 (spear-phishing, HTA/WSF staging, .NET deserialization, DLL sideloading of GatherOsState.exe/slc.dll, Microsoft Graph/Outlook/OneDrive C2) and shares the microsoft-flash[.]com and wps-cn[.]com delivery domains with Falcon. Unit 42 does not state whether Falcon's operator is the same as UAT-11587 or the Symantec 'Jewelbug' actor, so no actor attribution is made here. Impact is theft of government webmail credentials, sessions, email and communications and hands-on access to endpoints.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1218 System Binary Proxy Execution

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography

Collection

T1113 Screen Capture; T1114 Email Collection; T1185 Browser Session Hijacking

Persistence

T1176.001 Browser Extensions; T1547.001 Registry Run Keys / Startup Folder

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains

Remediation

Immediate actions

• Block Falcon C2 and delivery domains: fonts.tarotfree101.top, fonts.chrorne.com, robot.avbliud.com, microsoft-flash.com, wps-cn.com
• Hunt for and remove browser extension ID mbidcmlcbgbphpoacojjbmfpohcimjji and any extension installed in developer mode that masquerades as a PDF viewer
• Inspect internal webmail (Roundcube), ticketing and case-management page headers for <script> tags loading from unfamiliar domains, especially numeric arrays with a small decoder
• Hunt for Hm_lvt_ cookies/local storage keys on sites where Baidu Analytics has no legitimate role
• Search endpoints for %LOCALAPPDATA%\Windows GatherOSStateKit\, %TEMP%\SDIAG_*\result\result.ps1 and the Antino SHA-256 hash
• Reset credentials and revoke sessions for accounts that used affected webmail or web apps

Workarounds

• Restrict installation of software from fake update prompts; train users not to install Flash/Chrome updates delivered via web pages
• Egress-filter WebSocket connections to uncategorized newly registered domains

Longer-term hardening

• Enforce browser extension allow-listing and block developer-mode extension installs; alert on extensions requesting <all_urls>, debugger, tabCapture, nativeMessaging or webRequest
• Monitor OAuth/Graph traffic to OneDrive tenants outside the organization, especially repeated small JSON writes to antino/heartbeat/ or antino/antino_upload/
• Apply web integrity monitoring and a restrictive Content-Security-Policy on internal web apps and webmail
• Deploy EDR with behavioral detection for sdiagnhost.exe spawning PowerShell and unexpected Run key additions

Affected and fixed versions

• Roundcube — Roundcube Webmail
  Vulnerable versions: Portals with attacker-injected script tag in header (39 instances in one Middle Eastern ministry)
• Google — Chrome
  Vulnerable versions: Browsers with sideloaded malicious extension mbidcmlcbgbphpoacojjbmfpohcimjji
• Mozilla — Firefox
  Vulnerable versions: Browsers with sideloaded malicious extension (functionally identical Firefox build)
• Microsoft — Windows / OneDrive
  Vulnerable versions: Windows endpoints running Antino; OneDrive abused as C2 channel

Timeline

• 2025-09-01 Cisco Talos reports first observed UAT-11587 activity using the Antino backdoor (September 2025), tracked through July 2026.
• 2025-10-06 Earliest known Antino (Rust) sample is compiled, per Unit 42.
• 2026-03-01 Falcon campaigns against government entities in one Middle Eastern and four Southeast Asian countries begin (March-May 2026 window per Unit 42).
• 2026-04-01 Script tag injected into a Middle Eastern Ministry of Foreign Affairs Roundcube webmail portal header; 39 affected instances loading config_r5lfmqe3.
• 2026-04-23 firefox.zip (silent Firefox install tool) uploaded to a Falcon management panel.
• 2026-04-25 browser.exe (silent Chrome install tool) uploaded to a Falcon management panel.
• 2026-05-01 Custom Falcon module at a Southeast Asian police entity harvests usernames and shows fake Adobe Flash update prompts delivering Antino from locked-ioc-16 (May 2026).
• 2026-05-13 Malicious 'PDF Viewer' extension version 2026.5.13.1 (ID mbidcmlcbgbphpoacojjbmfpohcimjji) built; used against a Southeast Asian justice entity.
• 2026-06-08 Largest observed UAT-11587 Antino wave (June 8-9, 2026), about 57 newly observed endpoints linked to India, per Talos.
• 2026-09-30 Cisco Talos publishes UAT-11587 / Antino backdoor research with shared delivery domains locked-ioc-16 and locked-ioc-22.
• 2026-11-11 Unit 42 publishes 'The XG Files: Falcon C2 Flying Under The (Browser) Radar' detailing Falcon, the malicious extension and Antino.

Sources cited

• The XG Files: Falcon C2 Flying Under The (Browser) Radar Unit 42 · Research · 2026-11-11
• PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-Aligned Threat Groups Trend Micro · Research · 2026-01-01
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor Cisco Talos · Research · 2026-09-30
• The Jewelbug Dossier (Symantec by Broadcom) sed-cms.broadcom.com · Research · 2026-08-01
• Cisco Talos IOCs: UAT-11587 targets government GitHub · Code repository · 2026-09-30
• China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023 The Hacker News · News · 2026-01-01
• PeckBirdy Framework Tied to China-Aligned Cyber Campaigns infosecurity-magazine.com · News · 2026-01-01

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged Previous report