Why this matters

On 2026-11-11 Unit 42 (Palo Alto Networks) published research on Falcon (also called XG), a command and control framework that runs inside the victim’s browser. All facts below come from that report unless stated. Its own resource list points to related coverage from Cisco Talos and Symantec; we did not open those pages, so we do not rely on them here. Per Unit 42, an actor placed malicious JavaScript directly in webmail and government web applications, then used the framework to sideload malicious Chrome extensions and steal passwords, emails, session cookies and communications. Falcon also delivered a Rust implant Unit 42 calls Antino, which uses Microsoft OneDrive for C2. Unit 42 reports government compromises in one Middle Eastern country and four Southeast Asian countries between March and May 2026.

The hunting problem is that most of this activity leaves few file artifacts. The report’s own conclusion is that Falcon operates inside the browser sandbox and encrypts C2 over WebSocket, so detection leans on web server integrity, browser extension inventory and the Antino host artifacts.

What Unit 42 observed

  • Implant placement: a <script> tag injected into the header of a Middle Eastern foreign ministry’s Roundcube portal; Unit 42 counted 39 affected Roundcube instances in that country. The script response is a heavily numeric JavaScript array (XOR-encoded) with a small decoder loop.
  • Session markers: a persistent ID stored in local storage as Hm_lvt_$ and in a cookie prefixed Hm_lvt_ with an expiry in 2099. This mimics Baidu Analytics naming. Unit 42 assesses with high confidence that Falcon and the earlier PeckBirdy framework are variants of the same core.
  • Transport: TLS WebSocket with a {"heartbeat":"1"} message every minute. The management panel listens on TCP 8080 and the victim-facing listener on 443.
  • Extension: a Chrome extension named “PDF Viewer” (ID mbidcmlcbgbphpoacojjbmfpohcimjji, version 2026.5.13.1), sideloaded in developer mode, requesting 40 permissions and <all_urls> host access. The report documents the extension’s behaviour; we found no description in it of how the extension reached victims’ browsers.
  • Antino: Rust implant, earliest known sample compiled 2025-10-06. It copies itself to %LOCALAPPDATA%\Windows GatherOSStateKit\tmp<8 chars>.exe, writes a diagnostic answer file to %TEMP%\SDIAG_<GUID>\result\result.ps1, runs sdiagnhost.exe to execute a PowerShell snippet that adds a Run key, and polls OneDrive for command_req_<BotID>_<timestamp>.json, writing heartbeats under antino/heartbeat/.

Hunt 1: Roundcube and webmail template tampering

Your web server logs cannot see the browser implant, but file integrity can. Compare Roundcube skin and plugin templates against a known-good release and alert on new external <script src= references. Our assessment: a file integrity check on webmail template directories is the highest-value control here, because the implant is only a tag.

On the client side, proxy or DNS logs can match the three C2 domains from the report (defanged): fonts.tarotfree101[.]top, fonts.chrorne[.]com, robot.avbliud[.]com, and the payload domains microsoft-flash[.]com and wps-cn[.]com.

let falcon_domains = dynamic(["tarotfree101.top","chrorne.com","avbliud.com","microsoft-flash.com","wps-cn.com"]);
DeviceNetworkEvents
| where Timestamp > ago(90d)
| where RemoteUrl has_any (falcon_domains)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP

Hunt 2: the sideloaded extension

Developer-mode extensions are rare on managed fleets. Search for the known extension ID, then widen to the behaviour Unit 42 lists: unfamiliar extensions named like a utility with broad permissions. The queries in this article are untested starting points. This KQL looks for the ID anywhere in file paths or command lines; it will only catch the sample in this report.

union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(90d)
| where FolderPath has "mbidcmlcbgbphpoacojjbmfpohcimjji"
   or ProcessCommandLine has "mbidcmlcbgbphpoacojjbmfpohcimjji"
   or ProcessCommandLine has "--load-extension"
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

For the wider hunt, pull your browser management inventory (Chrome Enterprise, Intune or an EDR extension inventory) and list extensions installed outside the Web Store with <all_urls>, debugger, tabCapture, nativeMessaging or webRequest. Those are the permissions Unit 42 names as worth monitoring, alongside developer-mode installs of extensions that mimic common utilities such as PDF viewers.

Hunt 3: Antino persistence through sdiagnhost

Unit 42 describes the Run key being written by PowerShell launched under sdiagnhost.exe. This Sigma rule is an untested starting point, not a vendor detection.

title: Possible Antino Persistence via sdiagnhost Answer File
id: 3b6f9a1e-84c2-4d57-a0e1-5c7d2f9b6a42
status: experimental
description: Untested starting point based on Unit 42 reporting on Falcon/Antino. Flags creation of result.ps1 under a SDIAG folder in a temp path and writes to Antino's reported install folder.
logsource:
  category: file_event
  product: windows
detection:
  sdiag:
    TargetFilename|contains: '\SDIAG_'
    TargetFilename|endswith: '\result\result.ps1'
  install_dir:
    TargetFilename|contains: '\Windows GatherOSStateKit\'
  condition: sdiag or install_dir
falsepositives:
  - Legitimate Windows troubleshooting packs that use scripted diagnostics
level: medium
tags:
  - attack.persistence
  - attack.defense_evasion

Expect the SDIAG_ branch to fire on genuine troubleshooters; tune by parent process and by whether sdiagnhost.exe then writes a Run key.

DeviceRegistryEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "sdiagnhost.exe"
| where RegistryKey has @"\CurrentVersion\Run"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

For Splunk with Sysmon (event 13, registry value set):

index=sysmon EventCode=13 Image="*\\sdiagnhost.exe" TargetObject="*\\CurrentVersion\\Run*"
| table _time host Image TargetObject Details

Hunt 4: OneDrive used as C2

Unit 42 says Antino uses OneDrive credentials (tenant, client and user IDs) embedded in its configuration, and recommends watching for OAuth activity to OneDrive tenants outside your own and small JSON writes to antino/heartbeat/. If your proxy logs URL paths, search for antino/heartbeat and antino/antino_upload. Also look for non-Office processes, especially from %LOCALAPPDATA%, talking to Graph or OneDrive endpoints. Per Unit 42, no Rhai scripts have been observed in the wild, so do not expect that stage.

Gaps and caveats

  • The report does not say how victims reach the injected sites beyond the compromised portals, nor how extensions get installed; treat both hunts as coverage guesses.
  • Unit 42 says the code likely shows AI-assisted development. That is the vendor’s inference.
  • Everything above is untested against production telemetry. Validate on your own data before alerting.

References