Unit 42 lists 13 Falcon C2 targets in 5 countries, details 3 and does not say how attackers got in

13 targets in five countries, 3 described in detail (derived)

Unit 42's report on the Falcon command and control framework, published on 11 November 2026, has a table captioned "Campaign victims identified" that lists 13 targets in five countries: six in one Middle Eastern country, then three, one, two and one in four Southeast Asian countries (a count of the table rows). The text then details three of them: a ministry of foreign affairs' Roundcube webmail portal in the Middle Eastern country, a police entity in Southeast Asian country A and a justice entity in country B. That is 3 of 13, or 23 per cent (derived). Country C gets one sentence and country D appears only in the table. The report gives a date or period for three of the five countries (April, May and early 2026) and never says how the operator got a script into any website.

What that does not establish. The table is a list, not an account. Its column is headed Targets, and the report does not say how many of the 13 were compromised rather than targeted, how Unit 42 saw each one, whether any data left, or who the operator is. The summary says the compromises happened "between March and May 2026"; the word March appears nowhere else on the page, and the body dates are April, May and early 2026 (checked in the saved page). For country B the report says the intrusion "likely relied on a different initial access vector", a malicious Chrome extension, and then says "We are currently unaware of how an operator is deploying these browser extensions".

Palo Alto Networks, which publishes Unit 42's work, sells the products the report lists at its end, among them Prisma Browser, which the report says prevents the side loading of unauthorized extensions. Trend Micro and Cisco, whose earlier reports this briefing also reads, sell security products too. The vendors' statements are used here as statements, and their product lists are not evidence.

What Unit 42 says Falcon is

Unit 42 calls Falcon, also known as XG or Xiàng Gē, a command and control framework that compromises a victim's browser by running malicious JavaScript. Its summary says an actor used it against visitors of webmail portals and government web applications by "placing malicious JavaScript directly within these sites", and that it served as a delivery mechanism for an implant Unit 42 calls Antino, which uses Microsoft OneDrive as a command channel. The report describes the parts in this order.

The operator's server. The management page shows a blank page with no branding, disables the right-click menu, and hides its login form until the F9 key is pressed three times in a row; any other key resets the count. Unit 42 says this keeps the login away from bots and from services that take screenshots of web pages. The server is written in Node.js with a management listener on TCP port 8080 and a victim-facing listener on TCP port 443, and the default page on the victim-facing side is a JavaScript Tetris, in another instance Snake.

Zoom

Zoom

The implant. When someone visits an affected site, the site sends a request to the Falcon server, and the server generates an implant made unique for that browser session from two files, then obfuscates it by XOR encoding each character with a one byte key. The implant makes a 32 character lower case alphanumeric session identifier and stores it three ways: in local storage under a key beginning Hm_lvt_, in a cookie whose expiry is set to the year 2099, and in the extension's own storage if the extension is present. Unit 42 says the Hm_lvt_ name is "likely mimicking Baidu Analytics tracking identifiers". It keeps a TLS encrypted WebSocket open for as long as the tab is open and sends a small heartbeat message every minute.

What it can be told to do. After a key exchange, in which the server offers a 2048 bit RSA public key and the client sends back an AES key and initialisation vector wrapped in it, traffic is AES-256-CBC. The command that matters is run, which makes the implant evaluate JavaScript the operator sends with eval. Four built-in functions let an operator's custom modules label a session, send JSON, exfiltrate data and send a notification through Telegram. Unit 42 also says the code "likely used AI to assist with design and development", judged from coding style, variable names and comments, and gives one inconsistency in how two request hooks test a response code. That is the report's inference and it rests on style, not on any statement from the operator.

Zoom

The Chrome extension: 14 files, 40 permissions, no stated route in

Falcon has two browser extensions, one for Firefox and one for Chrome, which Unit 42 calls functionally identical. The Chrome one masquerades as a PDF reader called PDF Viewer, has 14 files and asks for 40 permissions, including access to credentials, cookies and network traffic, and an all-URLs host permission. It fetches the Falcon implant from the server and runs it in a sandbox page, and a content script injected into every site gives it the page's own context. The report adds that the Firefox hashes differ from the Chrome hashes for six of the 14 files and match for eight (derived by this site from the two indicator lists).

How it got there. The report is direct about this: "We are currently unaware of how an operator is deploying these browser extensions". It offers two guesses, labelled as such: an initial implant tricking a target into installing the extension, or a deployment utility run from the command line. The panel shows a tool called browser.exe, described in translation as plugins for silently installing Chrome, uploaded at 03:08 UTC on 23 April 2026, and firefox.zip, for Firefox, uploaded at 14:09 UTC on 25 April, about two and a half days later (derived). Unit 42 says it has "not been able to recover a sample" of the utility. In the one victim environment with the extension, country B, it says the extension was "sideloaded in Chrome's developer mode".

Zoom

Whether the extension was ever offered through the Chrome Web Store is not stated: the report does not mention the store. The report says only that the country B extension was sideloaded in developer mode, a route that does not use the store; it does not say where the file came from. The manifest's version string, 2026.5.13.1, looks like a date; the report does not say what it means, or whether the sample it describes came from the country B victim (this site's observation, not the report's).

Five countries, three accounts: the victim table against the text

The summary says the campaigns "targeted ministries of foreign affairs, defense and interior, and law enforcement agencies", "consistent with strategic intelligence collection objectives". The table has more entries than the text has accounts, and some entries are not in the summary's list.

The Roundcube case. Unit 42 says it saw the Falcon implant on the webmail portal of the Middle Eastern Ministry of Foreign Affairs in April 2026, and that it assesses with high confidence that the script runs on each Roundcube visited by a victim, giving the operator access to the inbox and account settings. It counted 39 affected Roundcube instances in that country and says "We have no evidence of any instances affected outside of the target country", which it takes to suggest a highly targeted campaign. The report names no Roundcube vulnerability and no CVE (checked: the page contains none). So how the operator gained the ability to edit a portal's header is not stated, and how Unit 42 came to see the page is not stated either.

The country A and B cases. In May 2026 a custom module read the text of a page element holding the signed-in username, reported it with the built-in note function, and later showed a fake Flash update prompt to users on a hard coded list, fewer than ten times each; clicking its button served the Antino implant. In country B, the extension's check-ins ran every 3 to 4 minutes for more than 3 weeks, while the implant in a page sends a heartbeat every minute; the report does not say why the figures differ (it may be a different component). Unit 42 says it saw the operator capture a full page screenshot of a routing slip in the justice department's document system, a request for approval of the release of persons deprived of liberty, plus plaintext credentials for the system. It does not say how many documents or credentials in total.

The telecom entry. The summary speaks of government entities. The table lists a Telecom Provider and a National Agency for Network Services beside ministries. The report does not say whether the provider is state owned, or whether the entries describe compromised networks or intended targets.

Zoom

"Entirely inside the browser": the label and the report's own list of files

The summary describes attackers "Operating entirely inside the browser context" as they sideload malicious Chrome extensions. The conclusion says Falcon "operates entirely within the browser sandbox, avoiding persistent file artifacts and encrypting all C2 traffic over WebSocket". As a description of the implant script in a page, that holds. As a description of what the report found, the report's own body lists things that are not in a page.

A friendly label doing the work of a control. The headline idea, a framework that flies under the browser's radar, suggests that nothing exists to find. The report's own detection advice contradicts that: it asks defenders to look for extensions in developer mode, for Hm_lvt_ cookies on internal applications, for script tags added to templates and for OneDrive traffic to other tenants. Every one of those is a configuration or storage artifact that a defender can list.

PeckBirdy: how far the overlap goes, and where it stops

Unit 42 compared Falcon with PeckBirdy, a scripting framework Trend Micro reported on 26 January 2026 (the page prints January 26th, 2026). It found near identical URL structures, payload delivery and communication protocols, with the main difference that Falcon's paths carry a /config/ prefix. Both use AES, but PeckBirdy uses a predetermined key where Falcon negotiates a session key wrapped in RSA. Both save the persistent session ID with the Hm_lvt_ prefix. Unit 42 concludes: "we assess with high confidence that Falcon and PeckBirdy represent variants of the same core framework".

Zoom

What that concludes, and what it does not. The conclusion is about code: the two are variants of one core framework. It is not a statement that one actor runs both, and Unit 42 does not make one. Trend Micro's own report matters here. It says PeckBirdy has been used by China-aligned APT actors since 2023, and it described two campaigns, SHADOW-VOID-044 and SHADOW-EARTH-045, that "could be linked to different China-aligned APT actors": it linked the first to UNC3569 with a moderate to high level of confidence, and said the link of the second to Earth Baxia "remains low confidence". So the framework Unit 42 compares Falcon with was already tied by its discoverer to more than one actor. Similarity of URL paths and of a cookie prefix shows shared lineage of code. It is not attribution.

An older technique. Trend Micro reported that in July 2024 its second campaign "injects PeckBirdy links into government websites", in one case on the login page of a government system, 21 months before the April 2026 Roundcube observation (derived). On Trend Micro's evidence, injecting script into a government site was already seen in PeckBirdy and is not what is new in Falcon. Unit 42 describes an extension, a negotiated session key and an Antino link that Trend Micro's report does not mention (this site's reading; Trend Micro's report may simply not have looked). Trend Micro's own wording on the cookie prefix is that it is "a known cookie prefix used by a legitimate service", while Unit 42 names Baidu Analytics as the service being mimicked.

Antino: two vendors, one tool, and differences between them

Unit 42 introduces Antino as "an implant we call Antino". Cisco Talos published its report on a cluster it calls UAT-11587 and a backdoor it named Antino on 30 September 2026, 42 days before Unit 42's report (derived), and Unit 42 lists that report under Additional Resources without saying how it relates. The overlap is not loose. Both of the two payload delivery domains in Unit 42's indicator list, microsoft-flash[.]com and wps-cn[.]com, appear in the Talos report, and the single Antino sample hash in Unit 42's list, ending 578bd, is in Talos's list, labelled as a Gen 2 standalone fake installer backdoor (all checked in the saved pages). Unit 42 says the sample's earliest known compile time is 6 October 2025, 401 days before its report (derived).

What each vendor says about who. Unit 42 names no actor and no country for Falcon. Its summary says an actor, its body says the operator, the operators and this actor, and its Table 8 is regional. Talos writes that it has "high confidence that UAT-11587 is China-nexus", based on the totality of evidence, and counts at least 10 confirmed and five probable affected institutions and about 350 compromised endpoints across eight countries. Neither report says the Falcon operator is the UAT-11587 operator. They share a tool and two domains; shared infrastructure and a shared tool are not the same as a shared operator, and Talos itself rates one infrastructure overlap with another cluster as low confidence "because cloud infrastructure can be reused". Unit 42 also lists a Symantec Jewelbug dossier; it was not read for this briefing.

The report does not say which Antino generation its description fits, and the Talos page says command availability varies by generation and build. For a defender that is the practical point: the two pages describe a Microsoft 365 channel from two angles, and a hunt built from only one may miss the other. For the Outlook side in detail, see this site's earlier briefing on the Talos report.

What Unit 42 states, and what it does not

What to do, in order

Unit 42's own advice, compressed. The report's conclusion asks defenders to watch for four things: extensions installed in developer mode, especially lookalikes of common utilities that ask for broad permissions; Hm_lvt_ cookies or local storage keys on internal or government web applications; script tags added to the templates or headers of internal webmail, ticketing or case management portals that load from unfamiliar external domains; and OAuth activity to Microsoft OneDrive tenants outside your own. Its product list (Advanced WildFire, Cortex XDR and XSIAM, Prisma Browser and others) is marketing; the four items need no product.

Technical details

Everything in this section is copied from the Unit 42 report published on 11 November 2026 and read on 12 November. Indicators are defanged exactly as Unit 42 prints them. This section holds no exploit, no loader code and no implant code; Unit 42 prints none that this site reproduces, and the Antino configuration values are redacted in the report. Blocks that this site worked out are marked derived.

The management page behaviour. What the Falcon server shows and how it hides. A defender who runs web crawls or screenshots against suspect hosts will see only a blank page unless the key sequence is sent; the report gives the ports so that a network team can look for a Node.js service on them.

Falcon is written in NodeJS and has two listeners.
Management panel interface: TCP port 8080
Victim-facing listener: TCP port 443
Default page on the victim-facing listener: a JavaScript Tetris (another instance: Snake)
Management page: blank, no branding, right-click menu disabled by a global contextmenu listener calling preventDefault()
Login form: hidden until F9 is pressed three consecutive times; any other keystroke resets the counter

The F9 counter. The report prints these lines as its Figure 1. They are transcribed here from the figure image so that a hunter can search captured page source for the pattern. The page that holds this code is the operator's management page, not a victim's page.

if (e.key === 'F9') {
    e.preventDefault();
    f9Count.current += 1;
    if (f9Count.current >= 3) {
        setShowLogin(true);
    }
} else {
    // Reset count if other keys are pressed
    f9Count.current = 0;
}

URL paths. The paths the Falcon server and PeckBirdy answer, as Unit 42's Table 1 prints them. The domain and the attack identifier vary by campaign. A defender looks in web proxy and DNS logs for requests whose last path elements are hta, html or wscript.

Falcon                                         PeckBirdy                                  Description
hxxps[:]//{domain}/config/{ATTACK_ID}           hxxps[:]//{domain}/{ATTACK_ID}              Standard payload
hxxps[:]//{domain}/config/{ATTACK_ID}/hta      hxxps[:]//{domain}/{ATTACK_ID}/hta         HTA application loader
hxxps[:]//{domain}/config/{ATTACK_ID}/html     hxxps[:]//{domain}/{ATTACK_ID}/html        HTML loader
hxxps[:]//{domain}/config/{ATTACK_ID}/wscript  hxxps[:]//{domain}/{ATTACK_ID}/wscript     JScript loader for HTA

Storage keys and protocol strings in the browser. These are what the implant and the extension write on a victim browser. They are what you search for in cookies, local storage and extension storage.

Session ID: 32-character lower case alphanumeric, kept in three places
1. Browser local storage key:  Hm_lvt_$
2. Cookie:  Hm_lvt__<session ID>=1  with path /  and an expiry date of the year 2099
3. Falcon extension storage: the session ID is also stored if a storageApi object is defined
Operator remark, read from local storage field  _domain_google_mark  or the cookie string  _domain_google_mark=
Heartbeat message every minute:  {"heartbeat":"1"}
Fake Flash prompt counter, local storage key:  popup_count  (prompt shown only if fewer than 10)
Clipboard replacement rules, chrome.storage.local key:  clipboard_replacer_rules  (empty by default)
Implant command APIs: xg_note (label session), xg_send (send JSON), xg_data (exfiltrate data), xg_notify (notify via Telegram)
Comet fallback commands: run, nothing
Key exchange: server pushes action pubkey (2048-bit RSA public key, PEM); client replies with action key_exchange; data then AES-256-CBC

The extension. The identifiers a browser management tool can match. The ID below is the one Unit 42 gives for the extension sideloaded in country B.

Chrome Browser Extension ID: mbidcmlcbgbphpoacojjbmfpohcimjji
name: PDF Viewer
version: 2026.5.13.1
description: Portable Document Format
manifest_version: 3
permissions: 40 in total; host_permissions: all URLs
content_scripts: content-script.js on every site; twitter-dm.js on *://*.twitter.com/* and *://*.x.com/*
page-accessible resource: chrome-extension://<extension ID>/analytics-core.js
Permissions the report says to watch for: all_urls, debugger, tabCapture, nativeMessaging, webRequest
Installed in developer mode (sideloaded); 14 files; Firefox build also exists

Chrome extension files, SHA-256 and file name:
3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9 - analytics-core.js
f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92 - background.js
88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862 - content-script.js
065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce - icon128.png
3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016 - icon16.png
5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2 - icon48.png
b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda - manifest.json
2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd - offscreen.html
356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c - offscreen.js
32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4 - page.html
e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb - page.js
265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0 - sandbox.html
66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d - sandbox.js
3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2 - twitter-dm.js

Firefox extension files that differ from the Chrome build (SHA-256 and file name):
2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575 - background.js
857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c - content-script.js
b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7 - manifest.json
898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6 - offscreen.js
b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce - sandbox.js
24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7 - twitter-dm.js

Firefox files with the same hash as the Chrome build: analytics-core.js, icon128.png, icon16.png, icon48.png, offscreen.html, page.html, page.js, sandbox.html

The panel's tools page. The upload times are the evidence for the silent installer. They show the files existed in the operator's panel on those dates; they do not show use on any victim.

Falcon management panel, tools page (translated by Unit 42):
Name of Document   Size      Description                                Upload Time
firefox.zip        0.38 MB   Plugins for silently installing Firefox    2026-04-25T14:09:06.000Z
browser.exe        0.62 MB   Plugins for silently installing Chrome     2026-04-23T03:08:40.000Z

Infrastructure and the Antino sample. Block these in DNS and proxy policy and search past logs. Do not browse to them.

Falcon C2 domains:
fonts.tarotfree101[.]top
fonts.chrorne[.]com
robot.avbliud[.]com

Payload delivery domains:
microsoft-flash[.]com
wps-cn[.]com

Payload URL in Southeast Asian country A (fake Adobe Flash Player prompt):
hxxps[:]//microsoft-flash[.]com/download/Adobe_installer.exe

Antino sample (SHA-256 - file name):
0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd - flashcenter_pp_ax_install_en.exe

Roundcube injection: a script tag in the portal header; the resource it loads is named config_r5lfmqe3

Antino on the host and in OneDrive. The paths a defender can search for on endpoints, and the OneDrive path names a cloud team can look for in sharing and audit logs for a tenant that is not theirs.

Antino persistence and host artifacts, as Unit 42 prints them:
%LOCALAPPDATA%\Windows GatherOSStateKit\tmp<8 char>.exe
DllSafeCheck64.dll and slc.dll (copied if present; Unit 42 says Antino does not import them)
id   (file holding the bot ID; a UUID string is written if it does not exist)
%TEMP%\SDIAG_<GUID>\result\result.ps1   (diagnostic answer file, run by sdiagnhost.exe)
Configuration: PE section .cfg, 65,535 bytes; first 4 bytes are the length (258, 0x102); XOR key 0xABCD; decoded configuration is JSON
Configuration fields: tenant_id, client_id, client_secret, user_id, remark, run, launch_mode (values redacted by Unit 42)
Earliest known sample file name: antino-client.exe; PDB string: antino_client.pdb

OneDrive channel:
antino/heartbeat/<Bot ID>.json            heartbeat, hostname, username, remark
command_req_<Bot ID>_<timestamp>.json     command file searched for in the OneDrive root folder
antino/antino_upload/                     used by upload_file and download_file

Commands (10): cmd, ps, system_info, list_files, add_to_run, exit, load, execute_program, upload_file, download_file

What the report does not print. No CVE, no Roundcube or webmail file path, no Snort or Yara rule, no OneDrive tenant, client or user identifier (redacted), no hash for the browser.exe utility, and no domain mapped to a specific country's campaign.

The question the report leaves open

Unit 42 says it found a script in the header of a ministry's webmail portal and does not say how it got there. So the question for anyone who runs an internal web application or a webmail portal is a plain one: if someone had added one line to your login page's header last March, which log would show who changed it, and when did you last look?

Key facts