FirewallFalcon, a free Linux server management tool promoted to VPN resellers and “free internet” operators, has been found secretly hijacking network traffic and giving its developer control over systems that install it.
Researchers say FirewallFalcon Manager combines legitimate tunneling features with malicious components that can redirect traffic, weaken server security, and, in older versions, install a universal SSH backdoor.
The campaign was uncovered by Flare cybersecurity researcher Assaf Morag after one of the company’s VPS honeypots was compromised and used to deploy FirewallFalcon. What initially appeared to be routine abuse of the server for SSH tunneling led researchers to investigate the unusually polished GitHub project and its active Telegram communities.
FirewallFalcon is advertised as an open-source tool for managing VPN, proxy, and SSH tunneling infrastructure. Its public code includes legitimate functionality for Nginx, HAProxy, V2Ray/XRay, DNS tunneling, SSL certificates, and Linux user management.
Its primary audience appears to be operators who resell SSH tunnels or provide services designed to bypass mobile carrier restrictions, particularly in the Middle East, Africa, and other emerging markets. Flare says the project was promoted through Telegram groups containing thousands of members and identified at least 650 live servers connected to its broader infrastructure.
The most serious behavior occurs when users install the tool's DT Tunnel component.
DTunnel is a legitimate Brazilian commercial tunneling platform whose software validates customer subscriptions against proxy.dtunnel.com.br. FirewallFalcon modifies this process so that requests intended for DTunnel are instead sent to an IP address controlled by the FirewallFalcon operator.
To make the redirection appear legitimate, a downloaded binary called install_mod adds a custom root certificate to the Linux system's trusted certificate store and modifies /etc/hosts so proxy.dtunnel.com.br resolves to the attacker's server.
Together, these changes create a man-in-the-middle position. Applications continue establishing encrypted TLS connections without warnings because the rogue certificate has already been trusted by the operating system, while traffic is silently routed through infrastructure controlled by the attacker.
Flare
Flare found that earlier versions were even more aggressive. Historical installers used SHC-obfuscated binaries to conceal additional scripts that collected server information and sent it through Telegram. Some variants also created a hardcoded privileged SSH account, allowing the operator to remotely access affected machines using known credentials.
Flare
The researchers also discovered a shared DNS API token embedded in the project. Analysis of the associated DNS infrastructure revealed hundreds of server addresses and recurring subdomain patterns, suggesting that FirewallFalcon was being used to coordinate a distributed network of tunneling and proxy systems rather than simply providing standalone management software.
Flare underscored how software supply chain attacks can extend into underground and gray-market ecosystems, where operators may install root-level tools without auditing the code.
Server administrators should be particularly cautious of management tools that install unsigned binaries, modify /etc/hosts, add root certificates, change SSH authentication settings, or communicate with hardcoded external servers. Systems that have run FirewallFalcon should be checked for unauthorized users, modified trust stores and DNS settings, and unexpected connections to external infrastructure.
Leave a Reply