Skip to content
Threat Feed
Subscribe
high threat exploited

Falcon C2 Browser-Based Threat Framework

Falcon is a browser-based C2 framework used to compromise webmail and government portals by injecting malicious JavaScript to steal sensitive information and deliver the Antino implant.

Triage facts

Revision 1
Evidence
Confirmed activeHigh confidence
Severity
High
Sources
1 public source
Freshness
Revision 1Nov 11, 15:39 UTC
Source quality
B2Likely

Falcon (aka XG or Xiàng Gē) is a browser-based command and control framework that compromises browser sessions via malicious JavaScript. Attackers have used the framework to target government entities in one Middle Eastern and four Southeast Asian countries. The framework supports the deployment of malicious Chrome and Firefox extensions that grant full browser control, including access to credentials, session cookies, and network traffic.

Attack Chain

  • Infection: Malicious JavaScript is injected directly into webmail and government portals.
  • Execution: The browser executes an obfuscated JavaScript implant that establishes a persistent WebSocket connection to the C2 server.
  • Persistence: Persistence is maintained through a three-tier strategy involving browser local storage, cookies, and extension storage.
  • Capabilities: The framework facilitates data exfiltration (passwords, emails, session cookies), proxy functionality using the victim's browser, and the delivery of the Antino implant.

Impact

Falcon was used to target ministries of foreign affairs, defense, interior, and law enforcement agencies for strategic intelligence collection.

Recommendation

Organizations should monitor browser environments for unauthorized extensions and suspicious WebSocket traffic. Conduct analysis of browser-based data exfiltration and ensure rigorous access control for web applications.

Threat Hunt

Identify suspicious browser extensions by auditing installed extensions for the 'PDF Viewer' name, which the framework uses as a masquerade, and monitor for extensions requesting sensitive 'host_permissions' such as '<all_urls>' or broad access to cookies and credentials.

T1176 high high confidence hunt now

Data: browser_extension_list, browser_extension_manifests

Search for persistent, non-standard WebSocket traffic patterns originating from browsers, specifically looking for heartbeats ('{"heartbeat":"1"}') or anomalous key exchange messages occurring over TCP/443, as the framework uses WebSocket-based C2.

T1071.001 medium medium confidence convert to detection

Data: network_stream_logs, proxy_logs

Hunt for unauthorized browser-based proxy activity by monitoring for 'chrome.runtime.sendMessage' events within browser telemetry that align with 'handleProxyRequest' logic, potentially indicating the browser is being utilized to access internal network resources on behalf of the attacker.

T1185 high high confidence hunt now

Data: browser_process_telemetry, browser_extension_api_logs