Threat video1:00
Falcon XG Browser C2 and Antino: Detection & IOCs
Falcon injects scripts and a rogue PDF Viewer extension to steal browser passwords, then drops Antino. 9 detection rules, 27 IOCs and a free Splunk SPL rule.
Read the full threat intel for Falcon XG Browser C2 and Antino: Detection & IOCs →
Chapters
- 0:00The hookFalcon hit governments in 5 countries.
- 0:04The storyFrom March, Falcon targeted government entities.
- 0:12Attack pathFalcon reportedly compromises browsers.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise24 indicators to hunt: 1 IP, 6 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from resource development to command and control.
- 0:43Remediation6 steps now: Block Falcon C2 and delivery domains.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Falcon hit governments in 5 countries.
0:05From March, Falcon targeted government entities.
0:08Targets included webmail, police and justice entities.
0:12Falcon reportedly compromises browsers.
0:15A police web app showed a fake Flash prompt.
0:18Victims ran the installer, delivering Antino.
0:21The implant held an encrypted link.
0:23Credentials and mail were stolen.
0:27No threat actor is attributed. Confidence: low.
0:3224 indicators to hunt: 1 IP, 6 domains and 1 URL, and more.
0:3818 ATT&CK techniques, from resource development to command and control.
0:446 steps now: Block Falcon C2 and delivery domains.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.