# Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications

> Unit 42 describes Falcon, a Node.js/JavaScript C2 framework that compromises browsers through injected scripts and a sideloaded malicious Chrome/Firefox 'PDF Viewer' extension to steal passwords, emails, session cookies and communications. Falcon also delivered the Rust-based Antino implant, which uses Microsoft OneDrive for C2; government compromises were observed in one Middle Eastern and four Southeast Asian countries between March and May 2026.

- **Published:** 2026-11-11T16:06:38Z
- **Last reviewed:** 2026-11-11T16:06:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5779
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5779.png
- **ID:** TL-2026-5779
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

Falcon (also called XG, from Xiàng Gē) is a C2 framework whose server is written in Node.js and exposes two listeners: a management panel on TCP 8080 and a victim-facing listener on TCP 443. The panel renders a blank page and only reveals a login form after the F9 key is pressed three times consecutively; right-click is disabled, and the victim-facing listener serves a JavaScript Tetris/Snake game as a decoy. Unit 42 assesses with high confidence that Falcon is a variant of the PeckBirdy script framework reported by Trend Micro in January 2026: both share near-identical URL structures (Falcon adds a /config/ prefix), the same HTA/HTML/JScript loader payload sequence, AES encryption, and Baidu-style 'Hm_lvt_' session identifiers. Unit 42 also assesses the code was likely developed with AI assistance (coding style, naming, comments, inconsistent design). The operator is not named by Unit 42.

Delivery observed by Unit 42 took three forms. (1) In April 2026 a script tag was injected into the header of a Middle Eastern Ministry of Foreign Affairs Roundcube webmail portal, loading an obfuscated implant from a config resource (config_r5lfmqe3) and intercepting credentials and sessions; 39 affected instances were identified, all in the target country. (2) In May 2026 a Southeast Asian police entity's web application was hit with a custom Falcon module that harvested the logged-in username (leftusername element, reported via xg_note) and displayed a fake Adobe Flash update prompt to hard-coded users fewer than 10 times (popup_count), leading to download of Adobe_installer.exe from microsoft-flash[.]com — the Antino implant. (3) In a Southeast Asian justice entity, a sideloaded Chrome extension disguised as a PDF viewer checked in every 3-4 minutes for more than three weeks, captured a full-page screenshot of a sensitive document, exfiltrated credentials, and logged 20+ routing-slip views between late April and mid-May 2026. Separate Falcon campaigns also hit a Southeast Asian military entity and a Southeast Asian Ministry of Foreign Affairs; Unit 42 does not explain how the extension is deployed (possibly via social engineering with a silent-install utility, firefox.zip / browser.exe uploaded to the panel on 2026-04-23 and 2026-04-25).

The per-session implant is built from victim_common.js and victim.js, XOR-encoded into an integer array with a small decoder, and tracked with a 32-character session ID stored in local storage key 'Hm_lvt_$', a cookie 'Hm_lvt__<session ID>=1' (expiry 2099) and extension storage. It holds a TLS WebSocket open with a one-minute {"heartbeat":"1"} message, negotiates a 2048-bit RSA key exchange for an AES-256-CBC session key/IV, and supports 'run' (arbitrary JavaScript via eval) and 'set_remark' commands, with an unencrypted 'Comet' fallback. Custom-module APIs include xg_note, xg_send, xg_data and xg_notify (Telegram notification).

The malicious extension (ID mbidcmlcbgbphpoacojjbmfpohcimjji, Manifest V3, v2026.5.13.1, 40 permissions and <all_urls>) provides a victim-browser web proxy using the victim's cookies, download interception/replacement (e.g. ChromeSetup.exe), network hooking of fetch/XHR (up to 500 cached responses), clipboard hijacking with replacement rules (account numbers, crypto wallet addresses), Gmail mailbox theft via the session cookie, Discord and Zalo chat capture, X/Twitter DM scraping, and collection of passwords/autofill (last 500), cookies, browsing and download history.

Antino is a Rust implant (earliest known sample compiled 2025-10-06) with an XOR-encoded (key 0xABCD) .cfg PE-section configuration containing OneDrive tenant_id, client_id, client_secret and user_id. It copies itself to %LOCALAPPDATA%\Windows GatherOSStateKit\tmp<8 chars>.exe, writes %TEMP%\SDIAG_<GUID>\result\result.ps1 and runs sdiagnhost.exe to execute PowerShell and add a Registry Run key. C2 is via OneDrive: heartbeat JSON to antino/heartbeat/<Bot ID>.json, polling for command_req_<Bot ID>_<timestamp>.json, and ten commands (cmd, ps, system_info, list_files, add_to_run, exit, load [Rhai script], execute_program, upload_file, download_file). Cisco Talos separately tracks Antino use by China-nexus cluster UAT-11587 (spear-phishing, HTA/WSF staging, .NET deserialization, DLL sideloading of GatherOsState.exe/slc.dll, Microsoft Graph/Outlook/OneDrive C2) and shares the microsoft-flash[.]com and wps-cn[.]com delivery domains with Falcon. Unit 42 does not state whether Falcon's operator is the same as UAT-11587 or the Symantec 'Jewelbug' actor, so no actor attribution is made here. Impact is theft of government webmail credentials, sessions, email and communications and hands-on access to endpoints.

## MITRE ATT&CK

- T1583.001 Domains
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1176.001 Browser Extensions
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1114 Email Collection
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1573.002 Asymmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Falcon/Antino Fake Flash Update Delivery — Domain Lookup and Installer Execution (Exploitation)** (`TL-2026-5779-SPL-001`)

Detects the delivery stage of the Falcon (XG) browser C2 campaign that pushes the Rust Antino implant: Sysmon DNS lookups of microsoft-flash.com, wps-cn.com and osc-cdn.com (also used by UAT-11587), and execution of the fake Adobe Flash installers Adobe_installer.exe / flashcenter_pp_ax_install_en.exe. Observed against a Southeast Asian police entity in May 2026.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036, T1583.001
- **Data sources:** sysmon:EventCode=22 (DNS query), sysmon:EventCode=1 (process create), index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h (EventCode=22 OR EventCode=1)
| eval dns_hit=if(EventCode=22 AND match(lower(QueryName), "(^|\.)(microsoft-flash\.com|wps-cn\.com|osc-cdn\.com)$"), 1, 0)
| eval exec_hit=if(EventCode=1 AND (match(lower(Image), "(adobe_installer|flashcenter_pp_ax_install_en)\.exe$") OR match(lower(CommandLine), "microsoft-flash\.com|wps-cn\.com|adobe_installer\.exe")), 1, 0)
| where dns_hit=1 OR exec_hit=1
| eval detection=case(dns_hit=1, "dns_to_antino_delivery_domain", exec_hit=1, "fake_flash_installer_execution")
| stats count min(_time) as first_seen max(_time) as last_seen values(QueryName) as queried_domains values(Image) as images values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, detection
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let DeliveryDomains = dynamic(["microsoft-flash.com", "wps-cn.com", "osc-cdn.com"]);
let NetHits = DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (DeliveryDomains) or RemoteIP == "103.27.110.220"
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, Detail = RemoteUrl, SourceTable = "DeviceNetworkEvents";
let ExecHits = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("Adobe_installer.exe", "flashcenter_pp_ax_install_en.exe")
        or SHA256 == "0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd"
        or ProcessCommandLine has_any (DeliveryDomains)
    | project Timestamp, DeviceName, AccountName, FileName, Detail = ProcessCommandLine, SourceTable = "DeviceProcessEvents";
union NetHits, ExecHits
| order by Timestamp desc
```

### Sigma

```yaml
title: Falcon/Antino Fake Flash Update Delivery Domain DNS Query
id: 6f1c2a10-5779-4a01-9b11-0a1d5f3c7e01
status: experimental
description: Detects DNS resolution of microsoft-flash.com, wps-cn.com or osc-cdn.com, domains used by the Falcon (XG) fake Adobe Flash update lure and UAT-11587 delivery of the Antino implant.
references:
    - https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/
    - https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.resource_development
    - attack.t1583.001
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036
    - attack.tool.falcon_xg
    - attack.tool.antino
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|endswith:
            - 'microsoft-flash.com'
            - 'wps-cn.com'
            - 'osc-cdn.com'
    condition: selection
falsepositives:
    - Security researchers or threat-intel sandboxes resolving the domains
    - Sinkholed or blocked lookups by DNS security tooling
level: high

```

**Known false positives:**

- Threat-intel analysts or sandboxes deliberately resolving these domains
- Legitimate software named Adobe_installer.exe from an unrelated vendor (verify hash and download origin)

**Tuning notes:** Requires Sysmon event 22 (DNS) and 1 (process create) in index=sysmon; change index/sourcetype to match your Sysmon input. Exclude hosts of your own malware-analysis lab. The Adobe_installer.exe name alone is weak, so pair hits with the delivery domain or the Antino SHA-256 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Falcon Malicious 'PDF Viewer' Browser Extension Sideload (Exploitation/Persistence) (locked: unlock with TL Creds)
- Antino Self-Copy Staging and [indicator] Sideload (Post-Exploitation) (locked: unlock with TL Creds)
- Falcon (XG) Browser C2 Domain and Infrastructure Contact (C2) (locked: unlock with TL Creds)
- Falcon (XG) Injected Script Loader URL Pattern and Roundcube Config Resource (Exploitation) (locked: unlock with TL Creds)
- Falcon Malicious Extension Files in Browser Profile (Post-Exploitation Collection) (locked: unlock with TL Creds)
- Antino OneDrive C2 Heartbeat and Command File Traffic (C2) (locked: unlock with TL Creds)
- Antino sdiagnhost.exe Proxy Execution and Run Key Persistence (Post-Exploitation) (locked: unlock with TL Creds)
- Antino OneDrive C2 Beaconing from Unusual Process (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `103.27.110[.]220`
- Domain: `fonts[.]tarotfree101[.]top`
- File hash: `0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The XG Files: Falcon C2 Flying Under The (Browser) Radar](https://unit42.paloaltonetworks.com/falcon-c2-browser-compromise/)
- [PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-Aligned Threat Groups](https://www.trendmicro.com/en_us/research/26/a/peckbirdy-script-framework.html)
- [China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor](https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/)
- [Cisco Talos IOCs: UAT-11587 targets government](https://github.com/Cisco-Talos/IOCs/blob/main/2026/09/uat-11587-targets-gov.txt)
- [The Jewelbug Dossier (Symantec by Broadcom)](https://sed-cms.broadcom.com/sites/default/files/2026-08/Jewelbug%20Dossier.pdf)
- [China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023](https://thehackernews.com/2026/01/china-linked-hackers-have-used.html)
- [PeckBirdy Framework Tied to China-Aligned Cyber Campaigns](https://www.infosecurity-magazine.com/news/peckbirdy-framework-tied-china/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5779