Falcon C2 Framework and Antino Malware Analysis

Unit 42 has detailed a sophisticated campaign between March and May 2026 targeting ministries of foreign affairs, defense, and law enforcement agencies across the Middle East and Southeast Asia. The primary tool, Falcon (aka XG or PeckBirdy), is a JavaScript-based C2 framework that operates entirely within the browser context. It was observed being delivered via script injection on government webmail portals and through malicious browser extensions masquerading as PDF viewers.

The framework facilitates the delivery of Antino, a Rust-based implant that leverages Microsoft OneDrive for Command and Control. The campaign targeted entities such as the Ministry of Foreign Affairs in a Middle Eastern country by compromising Roundcube webmail instances to intercept credentials and session cookies. The modular nature of Falcon allowed attackers to perform highly specific actions, including harvesting internal usernames and exfiltrating direct messages from social media platforms like X (formerly Twitter).

This activity highlights a shift toward browser-native exploitation that evades traditional endpoint detection by residing in web-application memory and legitimate browser components. The use of cloud services like OneDrive for C2 further complicates network-level detection by blending malicious traffic with legitimate business communications.