This open-source VPN manager is secretly owned by an attacker, researchers warn

Developers are being warned against a slick, legitimate-looking open-source tool that secretly hijacks network traffic – quietly handing attackers the keys to every system it's installed on.

FirewallFalcon Manager is being heavily promoted on Telegram to VPN resellers and "Free Internet" operators – people who help others get around mobile data restrictions.

It's marketed as a free, open-source tool for managing Linux servers, allowing users to manage VPN services, proxy servers, and network settings.

But dig beneath the polished GitHub repo and feature-rich shell menus, and something far darker emerges.

According to Flare cybersecurity researcher Assaf Morag, who uncovered the scheme, the tool hides "a multi-layered, well-hidden and sophisticated attack" – one that leaves operators who install it unknowingly handing over full control of their own infrastructure.

“Gray area” tooling under attack

Flare describes FirewallFalcon as a "gray area" toolset built for managing SSH/VPN tunneling servers – the kind of software that thrives in the underground VPN-selling scene across emerging markets like the Middle East and Africa.

Flare’s report notes that the most common language used in communications was a mix of English and Arabic.

It sits in a gray area between legitimate tunneling tools and infrastructure frequently abused for circumvention and sometimes cybercrime operations.

Assaf Morag, Flare cybersecurity researcher.

While these tools can have legitimate uses, they are also commonly used by attackers to hide their real IP address or make malicious activity harder to trace, making Falcon a potential hacker’s tool that can hack back.

In its analysis, Flare says the way FirewallFalcon spreads suggests that at least 50% of installations were done to "camouflage malicious activity as a defense evasion tool."

Yet on the surface, the tool looks legitimate: its public code manages real services like Nginx, HAProxy, V2Ray/XRay, DNS tunneling, SSL certificates, and Linux user accounts.

Whatever the reason someone installs it, Morag – who uncovered the campaign after one of his own honeypot servers was compromised and used to deploy FirewallFalcon – warned that "beneath the well-polished GitHub repo and feature-rich shell menus lies a multi-layered, well-hidden, and sophisticated attack."

How the attack works

According to Flare, the malicious tool’s main target appears to be operators who resell SSH tunnels or provide services designed to bypass mobile carrier restrictions.

The most serious issue happens when users install the tool's DT Tunnel component.

DTunnel is a legitimate Brazilian commercial VPN/tunneling service. Normally, its software checks whether a customer's subscription is valid by contacting proxy.dtunnel.com.br.

FirewallFalcon hijacks this check, quietly redirecting those requests to a server controlled by the attacker instead.

To pull this off without raising red flags, the malware secretly makes the computer trust the attacker by installing a fake security certificate.

It also redirects traffic intended for the real server to the attacker’s server, so the victim may not realize anything is wrong.

Combined, these changes let the attacker sit secretly between the user and DTunnel's servers – which Morag notes is a classic “man-in-the-middle” setup.

Promoted through Telegram

Flare found the tool promoted through 2 Telegram groups with thousands of members combined, and has identified at least 650 live servers tied to its broader infrastructure.

Morag notes that the campaign acts as a reminder that software supply chain attacks aren't confined to mainstream open-source projects – they reach into underground and gray markets too, where operators often install root-level tools without ever auditing the code or running basic security checks.

As Flare puts it, the attacker "identified a niche market... built a genuinely functional product that solves real operational problems, and distributed it freely to build trust. The tool works. The interface is polished. The features are real."