CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Falcon C2

malware · malware:falcon-c2 single-source

NodeJS command-and-control framework whose JavaScript implant runs inside the victim's browser, loaded from a script tag planted in government webmail portals and web applications (a Roundcube webmail at a Middle Eastern foreign ministry among them) and paired with a sideloaded Chrome extension disguised as a PDF viewer; Unit 42 names no operator and assesses with high confidence that it and PeckBirdy are variants of the same core framework (Palo Alto Networks Unit 42, 2026-11-11).

Aliases: XG, Xiàng Gē

Coverage
1
first 2026-11-12 → last 2026-11-12
Latest activity
2026-11-12
Unit 42: Falcon C2 runs inside the browser, fed by a script tag in government webmail such as Roundcube
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector · regions: middle-east, apac
Sources cited
3
3 hosts

Defender insights

What each entry about Falcon C2 tells a defender to do, newest first.

2026-11-12NOTABLEUnit 42: Falcon C2 runs inside the browser, fed by a script tag in government webmail such as Roundcube

Exposure · triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

variant of

Story timeline

  1. 2026-11-12Falcon: Unit 42 describes a browser-resident command-and-control framework planted in government webmail and web applications, with a script tag in Roundcube at a Middle Eastern foreign ministry and a sideloaded 'PDF Viewer' extension elsewhere; it shares its core with PeckBirdy
    active-threatsUnit 42: Falcon C2 runs inside the browser, fed by a script tag in government webmail such as Roundcube

Hunting pivots

Affected products
Google ChromeRoundcube Webmail
Tags
espionage
ATT&CK techniques (13 across 8 tactics)

13 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessDrive-by Compromise
  • ExecutionUser Execution: Malicious File
  • PersistenceSoftware Extensions: Browser Extensions · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationBoot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • StealthObfuscated Files or Information · Masquerading: Match Legitimate Resource Name or Location
  • Credential AccessInput Capture: Web Portal Capture · Steal Web Session Cookie
  • CollectionInput Capture: Web Portal Capture · Screen Capture · Browser Session Hijacking
  • Command and ControlApplication Layer Protocol: Web Protocols · Web Service: Bidirectional Communication · Encrypted Channel: Asymmetric Cryptography

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Execution TA0002

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Persistence TA0003

T1176.001Software Extensions: Browser Extensions×1

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Privilege Escalation TA0004

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Credential Access TA0006

T1056.003Input Capture: Web Portal Capture×1

Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Collection TA0009

T1056.003Input Capture: Web Portal Capture×1

Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1113Screen Capture×1

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1185Browser Session Hijacking×1

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

T1573.002Encrypted Channel: Asymmetric Cryptography×1

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

Evidence: 2026-11-12/falcon-c2-browser-implant-government-webmail-script-tag · ATT&CK page ↗

Entries about Falcon C2 (1)

2026-11-12 · view entry permalink →

NOTABLENATOB2

Falcon: Unit 42 describes a browser-resident command-and-control framework planted in government webmail and web applications, with a script tag in Roundcube at a Middle Eastern foreign ministry and a sideloaded 'PDF Viewer' extension elsewhere; it shares its core with PeckBirdy

Unit 42 describes Falcon C2, also called XG and not the CrowdStrike Falcon sensor, a NodeJS command-and-control framework whose operator-controlled JavaScript implant runs inside the victim's browser, so the endpoint holds no file for it (Unit 42, 2026-11-11). A script tag placed in a trusted site makes each visit request the implant from the Falcon server, which returns a script obfuscated per browser session, and the implant then holds a TLS WebSocket to the server while the tab is open and runs operator JavaScript through eval (Unit 42, 2026-11-11). Unit 42 identified compromised government entities in one Middle Eastern and four Southeast Asian countries between March and May 2026, among them ministries and law enforcement agencies, and names no actor (Unit 42, 2026-11-11).

In April 2026 a script tag inserted into the Roundcube webmail portal of a Middle Eastern ministry of foreign affairs let the operator intercept credentials as users signed in and monitor sessions (39 Roundcube instances in that country, none observed elsewhere; how the tag got in is not stated) (Unit 42, 2026-11-11). In May 2026 a module in a Southeast Asian police web application harvested usernames and then showed a fake Adobe Flash Player update prompt to chosen users, which served the Antino implant that uses Microsoft OneDrive for command and control (Unit 42, 2026-11-11). Against a justice-department entity in another country, a Chrome extension named PDF Viewer, sideloaded in developer mode, checked in every 3 to 4 minutes for over three weeks and exfiltrated plaintext credentials for an internal correspondence system and a screenshot of a document the victim was viewing (Unit 42, 2026-11-11). The Jewelbug campaign also used an extension named PDF Viewer (Symantec, 2026-08-13); Unit 42 lists it only as a further resource.

Unit 42 assesses with high confidence that Falcon and PeckBirdy (Trend's JScript framework used by China-aligned actors since 2023) are variants of one core framework; that is code lineage, not who operates Falcon (Unit 42, 2026-11-11; Trend Micro, 2026-01-26).

Triage: Unit 42's basis for the cookie check is that Baidu Analytics cookies are normal on sites that use that service and anomalous on internal government web applications where it has no reason to appear (Unit 42, 2026-11-11).

We are currently unaware of how an operator is deploying these browser extensions.

We observed a total of 39 Roundcube instances being affected within the target country.

Based on these extensive technical overlaps, we assess with high confidence that Falcon and PeckBirdy represent variants of the same core framework.

Palo Alto Networks Unit 42 2026-11-11

Builds on: A hack-for-hire group hit 15+ government webmail tenants with one script tag, then escaped the… · Talos: Antino's traffic ends only at Microsoft's Graph and login endpoints, so network…

threat12 Nov 04:05Zsingle-sourceOpen finding →
Sources: Palo Alto Networks Unit 42 · Trend Micro (TrendAI) · Symantec Threat Hunter Team (Broadcom)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • security.com1 (33%)
  • trendaisecurity.com1 (33%)
  • unit42.paloaltonetworks.com1 (33%)
All cited sources (3)