Falcon C2 Framework Compromises Government Browsers in Southeast Asia and Middle East

• •Falcon C2 framework targets government agencies using malicious JavaScript.
• •Attackers compromised browsers to steal credentials without traditional endpoint implants.
• •The incident involved the delivery of a Rust implant named Antino via compromised web applications.

Unit 42 has identified the Falcon command-and-control framework, also known as XG or Xiàng Gē, which has been used to compromise browsers of government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. The framework executes malicious JavaScript within the browser, allowing attackers to intercept credentials and gain unauthorized access to government applications. Attackers injected malicious scripts into webmail portals and government applications, targeting ministries of foreign affairs, defense, and law enforcement. The Falcon framework conceals its management interface and uses games like Tetris as camouflage. Additionally, it delivered a Rust implant called Antino, which communicates via Microsoft OneDrive. The incident highlights the growing sophistication of browser-based attacks against government infrastructure.