Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

Note: This report is the result of a collaborative investigation between the Hunt.io research team and NetAskari, an independent journalist and researcher specializing in Chinese cyber operations and online surveillance.

While conducting routine open-source research, NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app. Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase.

Key Findings

• A fake Public Security Bureau app distributed via attacker-controlled domains was the entry point, confirmed in a June 2026 Chinese state media notice warning citizens of fraudulent applications disguised as official government services.

• Flying Eagle combines APK generation and full-featured C2 device management in a single panel, with phishing overlays for financial, adult, and government service apps

• The source code was stolen in early 2026, along with nearly 200 customer databases, leading to multiple modified variants circulating across criminal actors

• At least two Telegram channels, SQLRCE0 and Yx科技, are distributing patched versions of the leaked codebase with operational support and cash-out services

• Telegram channel messages reference international templates, suggesting targeting beyond Chinese users is possible

• A likely successor platform called Night Dragon (夜龙) was introduced by SQLRCE0 on June 23, 2026, with version 2 already in development

The investigation that follows traces how a set of shared indicators led to a broader view of the infrastructure supporting this activity.

Initial Infrastructure Analysis

The indicators highlighted in the public notice included two IP addresses, 207.56.30[.]188 and 207.56.30[.]194, in addition to several resolving domains. Both servers are hosted on AS54801 (Zillon Network Inc.) in Hong Kong. During our analysis, it was identified that 207.56.30[.]194 hosted Let's Encrypt TLS certificates for three domains across overlapping timeframes: fusu.us[.]ci, 110gongan[.]com, and ls.j2x8a[.]top. The certificates were rotated on almost a monthly basis.

IP intelligence data indicated pivots available on the ls.j2x8a[.]top certificate subject, returning two additional servers in HuntSQL: 108.187.7[.]66 and 108.187.7[.]71, both hosted on AS138995 (Antbox Networks Limited), also located in Hong Kong.

Query:

SELECT
  *
FROM
  ip
WHERE
  tls.cert.subject.common_name = 'ls.j2x8a.top'

                
Copy

Example Output:

The new IPs hosted a Chinese-language login panel on port 443 with the page title "阿力科技" and a login route at /login?redirect=list/basic-list. A separate login panel on port 80 of 207.56.30[.]194 titled APK Confusion Manager (APK 混淆管理后台) differed in structure and styling suggesting the two are distinct applications. The confusion manager's relationship to this campaign remains unclear at this time.

Inside the Flying Eagle Framework

The source code, distributed via the Telegram channel Yx科技 (English: Yx Technology) consists of a 388 MB archive labeled 中国龙.zip (Chinese Dragon). The ZIP contains a full Docker deployment; nginx web server, PHP, MySQL, and a Node.js WebSocket server. Also included are APK build tools, phishing templates, and a default TLS certificate.

The Docker image bundles Java 11 and Android SDK build tools, allowing users to create customized apps. The APK generation module accepts user-defined lured text, application names, icons, and C2 callback addresses, then builds a signed APK using one of two base templates. Additional observed templates: Chinese adult streaming services, TikTok, financial applications, and landing pages for public welfare projects that send the number of visits and downloads back to the operator.

To obtain a better understanding of how the program works, and to identify additional network indicators, we decided to stand up a test instance of Flying Eagle in an isolated environment. Upon install completion, a login panel is available at localhost/login?redirect=/basic. Before the operator-customized page renders, the page briefly presents a title of "AdminPro." This was also observed on the page identified in the previous section.

ApkBuilder.php

The APK build process revealed several features designed to make each generated sample unique and resistant to static detection. The script replaces the hardcoded package name, com.icontrol.protector with a randomly generated alternative constructed from legitimate sounding segments (e.g., com.cloud.manager.core). Easily detected class names are renamed with 8-14 character randomized strings. The original class identifiers reflect the malware's core capabilities:

• RecordPayPassword - payment credential capture

• LiveKeysStrok - keylogging

• ScreenCaps - screen capture

• Webjector - web injection / phishing overlays

• AccessibilityActivity - accessibility service abuse

• CameraCap - camera access

C2 callback URLs embedded in each APK are encrypted using AES-128-CBC with hardcoded default IV, password, and salt derived through PBKDF2-SHA1 with 65,536 iterations. Source code comments note the above values maintain compatibility with the original Windows .NET binary (EaodWorker.exe), indicating the Docker version is a direct port.

Malicious samples generated by the builder, including the 110gongan[.]com APK and base templates found under /user/apps/ in the archive, are detected by sandboxes as SpyNote Android malware. The files share several core behaviors with modern builds linked to the RAT, notably Accessibility Service-based privilege escalation, gesture injection via dispatchGesture, and remote communications over WebSocket and Firebase.

To further evade AV detection, the builder injects 2.8-3.5 MB of structured JSON files into the APK's assets directory. Rather than using random bytes which can trigger heuristics scanners, the script uses padding consisting of Base64-encoded values posing as SDK configuration caches. The developer left a comment noting as much that the reduced entropy avoids triggering antivirus alerts while resembling legitimate data.

Connecting the 110gongan[.]com Sample

A comparison of the malicious APK referenced in the security notice showed multiple structural overlaps with the above generation process: Identical numbered .bt asset architecture, identical asset directory layout, matching four-DEX structure, and the same style of packed and encoded resources.

The malware was hosted via the attacker-controlled domain, 110gongan[.]com. GongAn is Pinyin for "Public Security," and is an abbreviation for Provincial Public Security Bureaus in China.

A hardcoded C2 domain, fusu666[.]cc which resolves to 207.56.30[.]188 presented a login panel branded with Yx科技 (Yx Technology), which led us to their Telegram channel.

TLS Certificate

A TLS certificate included in the archive's docker/ssl directory was issued by Let's Encrypt for the domain alcs.xyttkx[.]cc. The fields and values are below:

A HuntSQL search for servers hosting certificates using xyttkx[.]cc returned additional subdomains: txl.xyttkx[.]cc, h5.xyttkx[.]cc, and alcs.xyttkx[.]cc across 12 IPs over the past 30 days. The servers also presented login pages matching the AdminPro template and route structure described previously. The webpage title and HTTP response and default certificate provided two independent fingerprints for identifying additional infrastructure.

Query:

SELECT
 *
FROM
 ip
WHERE
 tls.cert.subject.common_name LIKE '%xyttkx.cc%'
 AND timestamp > NOW - 30 DAY

                
Copy

Example Output:

Expanding the Network Infrastructure

We crafted two HuntSQL queries to look for similar login panels matching the AdminPro title, and those using the default certificate described in Table 01.

When accessed directly, Flying Eagle servers respond with an HTTP 302 redirect to the HTTPS address before rendering the login page. The redirect includes a consistent set of headers, notably Strict-Transport-Security: max-age=31536000 and a Location header pointing to the server's IP or domain. The underlying template resolves to "AdminPro" before the operator's custom branding loads. Combined, this formed a reliable hunting fingerprint:

SELECT
 *
FROM
 ip
WHERE
 same_port(
   service.port = 443
   AND html.head.title = 'AdminPro'
   AND protocol.data LIKE '%Strict-Transport-Security: max-age=31536000%'    
   AND protocol.data LIKE '%302 Moved Temporarily%'
   AND protocol.data LIKE '%Location: https://%'
) 
AND http.last_seen > NOW - 30 DAY

                
Copy

Output:

This resulted in 158 unique servers over a 30-day period. We should note this count is likely conservative, as additional servers matching the title, route structures and headers but not returning the expected 302 were excluded.

A separate query for servers using the default TLS certificate returned 12 additional, unique servers from our previous search, bringing the total to 170.

Focusing on the larger dataset, the infrastructure is concentrated across a small number of ASNs, primarily in Hong Kong, with a smaller presence in the United States and mainland China. Individual server instances were also observed in Finland, Malaysia, Canada, and Japan.

A number of the login pages used custom branding (飞鹰 --- Flying Eagle, 百事可乐 --- Pepsi Cola, and 阿力科技 --- Ali Technology among others). The preference for Hong Kong-based providers, several of which have appeared in prior Hunt.io reporting on China-nexus infrastructure, is consistent with the operators communicating on the Telegram channels which we'll discuss next.

A look into China-Nexus Mobile Cybercriminal Systems

A misspelled environment variable (SECRIT_KEY) found within the ZIP archive we reviewed provided an unexpected pivot. Querying Attack Capture's Code Search returned an open directory carrying the same typo at 77.105.161[.]235:8000, captured on March 13, 2026.

The server, hosted on AS44493 (New Hosting Technologies LLC) in Finland, contains 2,383 files across 576 sub-directories totaling 1.4 GB. The directory structure was a mirror image of the Flying Eagle source code, but configured for a Windows XAMPP deployment (Apache, MySQL, PHP) rather than Docker.

Among the files were deployment instructions further referencing identically named PHP files (Eaod85401.php, Eaod29251.php) and hardcoded credentials seen in the Docker version. These findings confirm the deployments share a common codebase.

New in Hunt.io 3.0, Attack Capture Attack Reports turned the thousands of files into a structured analysis, identifying pivots on IPs, domains, IOCs, and attribution indicators. Of note, the server also contained an AnyDesk license key paired with the IP 154.44.25[.]12 (AS979, Hong Kong), and fetched PHP-CGI exploit code from 85.137.253[.]48:8000 (AS215428, Germany).

s.orove[.]cn was also identified as a domain for a Feiying (Flying Eagle) panel, and a sample of BTMOB V4.0 was also found in the directory, further pinpointing the intended actions of the operator.

Lastly, within the instruction file was a Telegram handle: @SQLRCE0. This indicated the same individual was behind the open directory, or received a different version of the Android remote access program.

Two Channels, A Single Codebase

The Telegram channel Yx科技 (Yx Technology) was created in early April 2026. The first messages weren't what you'd expect, a greeting and description of the channel, but step-by-step instructions on using remote access tools to drain funds from Alipay and WeChat bank accounts. The message referred victims as "fish" (鱼) and offered cash-out channels at 20-50% transaction fees. On April 26, the channel distributed a free copy of Flying Eagle under the aforementioned 中国龙.zip.

Subsequent posts included screenshots of users demonstrating control of infected devices, as well as images of a tool named GitHub V1.2, believed to be a standalone application for building malicious APKs. The APK builder was not available for download and should not be confused with the popular code hosting platform. A password-protected copy of BTMOB RAT v4.5.5 was posted on the channel May 22nd, however we were unable to conduct further analysis on its contents.

The SQLRCE0 channel predates Yx Technology, and was created on February 4, 2026. Its first post was a zip archive labeled 飞鹰控打包.zip (English: Feiying Controller Package.zip). The contents of the archive bore a strong resemblance to what we have identified as Flying Eagle. On February 5, the channel posted messages points to a leak of the Flying Eagle source code along with a screenshot of a chat between an unidentified party and the malware's developers using the name 飞鹰技术 (Flying Eagle Tech).

The chat showed a negotiation over access to 189 Feiying server and exfiltrated database, with the unknown party claiming to have compromised customer infrastructure. SQLRCE0 used the ensuing messages to make multiple fixes to the leaked source code: domain connectivity, WebSocket stability, anti-uninstall features, and more all while assuring users with a money back guarantee that all backdoors had been removed from the code.

Neither channel appears to be the original developer of Feiying/Flying Eagle. Both distribute modified versions of a codebase that is likely circulated widely across cybercriminal groups post compromise. Yx Technology appears to function as a sales and operational support channel for the platform, while SQLRCE0 is positioning themselves as a technical resource, going so far as to offer a "fully repaired" version for 2,000 USDT and eventually go on to develop a possible successor.

SQLRCE Panels

During our investigation into the SQLRCE0 channel, we discovered a login panel with similar behavior to AdminPro, including the /login?redirect=/list/basic-list URL structure under the Telegram accounts name. A HuntSQL query returned 57 unique servers active within the past 30 days:

SELECT
 *
FROM
 ip.current
WHERE
 html.head.title LIKE '%SQLRCE%'
AND
 http.last_seen > NOW - 30 DAY

                
Copy

Output:

The similarities between the two projects suggests either a forked version or a parallel build from the same source.

Below is a timeline of the observed activity.

The possible relationship to the Night Dragon platform developed by SQLRCE0 as a likely successor to Flying Eagle is something we'll explore in the following section.

Night Dragon: A Mobile RAT Successor?

On June 23, 2026, SQLRCE0 introduced Night Dragon (夜龙), a separately developed Android remote control kit. The announcement describes it as compatible with all devices, and features including password capture for financial applications (Alipay, WeChat, banking apps), a black-screen mode that displays fake system updates to make operator activity, and automatic icon hiding after installation. The introduction explicitly identifies the code as backdoor-free, offering a full refund if any were discovered.

Querying for associated login pages in HuntSQL returned just two active servers, both hosted on AS54801 (Zillion Network Inc.) in Hong Kong. This provider appears to be a favorite for mobile malware infrastructure, as the 110gongan[.]com campaign used the same hosting service. The low number of results could be the result of the relatively new release of Night Dragon, or variants of the page could be circulating that have yet to be identified.

Query:

SELECT
 *
FROM
 ip
WHERE
 html.head.title LIKE '%夜龙 控制台%'

                
Copy

Example Output:

One of the servers exposed an active device management panel at the time of analysis. The page showed 46 devices online with 29 actively connected, all located in China. We were unable to verify if these are in fact actual victims, or a testing page containing dummy data. Operator account names used varying translations to "get rich," consistent with financially motivated criminal actors.

The device control interface provides full remote access including live screen viewing, SMS and photo gallery access, audio recording, camera capture, and file management. A phishing overlay system allows operators to deploy credential capture prompts for specific applications, with single-click shortcuts for Alipay, WeChat, and major Chinese banks including ICBC, Construction Bank, and Agricultural Bank, in addition to cryptocurrency wallets TokenPocket and imToken.

Night Dragon represents an evolution beyond the variants of Flying Eagle. Where Yx Technology and SQLRCE0 both distributed modified versions of an existing codebase, this project appears to be an independent build, which is currently in active version 2 development as of July 12th. Its emergence just three weeks after the public safety notice suggests the demand for Chinese-language Android RAT tooling continues to drive criminal actors even as existing platforms are exposed.

Here are the main IOCs from this investigation:

Indicators of Compromise

All indicators below were observed directly during this investigation. The full list is available here.

Table 1: Network infrastructure

Table 2: Domains

Table 3: TLS certificate (default, packaged with Flying Eagle installs)

Table 4: Host and file artifacts

Table 5: File Hashes - SHA-256

Table 6: Original class names (renamed at build time)

Build-time obfuscation: class names replaced with randomized 8 to 14 character strings. C2 callback URLs encrypted with AES-128-CBC, hardcoded default IV, password and salt, key derived via PBKDF2-SHA1 at 65,536 iterations. Builder injects 2.8 to 3.5 MB of Base64-encoded JSON into the assets directory, posing as SDK configuration caches to keep entropy low.

Table 7: Telegram

Table 8: Related tooling observed

Table 9: Panel fingerprints

Conclusion

A small set of indicators tied to a fraudulent Public Security Bureau application opened into a broader view of a commodity Android RAT environment. The shared codebase, traced via a misspelled environment variable and identically named PHP files, connects the initial campaign to an active network of criminal actors distributing and modifying leaked Flying Eagle source code.

The activity observed is heavily financially motivated and as of right now primarily targets Chinese citizens through social engineering lures tied to government services, adult content, social media, and financial applications. New platforms like Night Dragon will certainly continue to pop up alongside active Telegram channels offering user support and cash-out services, suggesting these and other operators will persist even as individual projects are exposed. Hunt.io will continue to monitor for new infrastructure tied to these platforms, as well as any malware delivery pages that may appear.

→ If your team tracks mobile malware infrastructure or monitors for threats like these, book a demo to see how Hunt.io can support your investigations.