The XG Files: Falcon C2 Flying Under The (Browser) Radar
Source Palo Alto Unit 42
Description
Falcon C2 is a browser-based command and control framework that compromises victims by running malicious JavaScript within browsers. It targets government entities primarily in one Middle Eastern and four Southeast Asian countries, focusing on ministries of foreign affairs, defense, interior, and law enforcement. The framework uses obfuscated JavaScript implants to steal sensitive data such as passwords, emails, session cookies, and communications. Falcon also delivers the Antino implant, which uses Microsoft OneDrive as a C2 channel. The framework employs operational security measures to hide its management panel and uses persistent session tracking mimicking legitimate analytics. It communicates via encrypted WebSocket connections and can sideload malicious Chrome extensions. Falcon shares significant technical overlap with the PeckBirdy framework, suggesting they are variants of the same core toolset.