Falcon
| Active
None
Victims
7
First Victim
2026-07-14
(est. attack date)
Discovery Date
2026-08-30
Last Seen
2026-11-03
Inactive Since
5
days
Avg Delay
28
days
Infostealer
100.0%
victims with domain
Countries
1
hit
Uptime
70.4% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
-67% vs last month
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Falcon | Yes | 2026-11-08T02:44:09 | nginx |
i7loab6thvz4lb7jdr3qoeumbvilwhbgnwsctnlfmvsv7g5s3vsiw6yd.onion
|
Target
Top 5 Activity Sectors
- Professional Services 3
- Healthcare 2
- Manufacturing 2
Top 5 Countries
-
United States
7
Heatmap
KQL Query (2)
-
Burst of M365 Downloads Following Risky Sign-In (AiTM to SaaS Exfil)
Exfiltration
Sentinel
T1530 -
MFA Method Reset/Registration Change (Helpdesk Vishing Indicator)
Persistence
Sentinel
T1556.006
Indicators of Compromise (IoCs) (1)
PGP
1
| Type | IOC |
|---|---|
PGP
|
|
Victims (7)
Full-service law firm - Our 260 GB extraction includes full DynamicCRM export with account, contact …
Plaintiff litigation law firm - Our 214 GB extraction includes executed agreements, final settlement…
Mass tort litigation law firm - Our 82 GB extraction includes confidentiality agreements, stipulatio…
Healthcare services · NASDAQ: ASTH - Our 738 GB extraction includes internal documents, regulatory …
Pool & spa equipment · NYSE: HAYW - Our 848 GB extraction includes your Salesforce, 1+ million of e…
Medical devices · NYSE: GMED - Our 2.96 TB extraction includes your entire Microsoft PowerBi which …
Energy & industrial distribution · NYSE: DNOW - Our 344 GB extraction includes your corporate infor…