Curious Serpens’ FalseFont Backdoor: Technical Analysis, Detection and Prevention

Unit 42 analyzes FalseFont, an ASP.NET Core backdoor used by the suspected Iranian-affiliated APT Curious Serpens that masquerades as aerospace hiring software to target job applicants; FalseFont provides remote command execution, file operations, credential theft, screen capture, persistent installation, and dual C2 channels (periodic HTTP polling and real-time SignalR), and the report supplies technical details, IOCs (hashes, mutex, persistence paths, C2 domain/IP, AES key), and recommended detections/mitigations via Palo Alto Networks products.