Malware

Flying Eagle

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

A fake Public Security Bureau app distributed via attacker-controlled domains was the entry point... Flying Eagle combines APK generation and full-featured C2 device management in a single panel, with phishing overlays for financial, adult, and government service apps

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Flying Eagle combines APK generation and full-featured C2 device management in a single panel... remote communications over WebSocket and Firebase.

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence1

The files share several core behaviors with modern builds linked to the RAT, notably Accessibility Service-based privilege escalation, gesture injection via dispatchGesture...

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

The files share several core behaviors with modern builds linked to the RAT, notably Accessibility Service-based privilege escalation, gesture injection via dispatchGesture...

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The APK build process revealed several features designed to make each generated sample unique and resistant to static detection... class names are renamed with 8-14 character randomized strings... C2 callback URLs embedded in each APK are encrypted using AES-128-CBC... the builder injects 2.8-3.5 MB of structured JSON files into the APK's assets directory.

T1036MasqueradingEvidence1

NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app.

Credential Access

3 techniques

T1056.001KeyloggingEvidence1

The original class identifiers reflect the malware's core capabilities: ... LiveKeysStrok - keylogging

T1056.003Web Portal CaptureEvidence1

Webjector - web injection / phishing overlays

T1649Steal or Forge Authentication CertificatesEvidence1

The announcement describes it as compatible with all devices, and features including password capture for financial applications (Alipay, WeChat, banking apps)...

Collection

4 techniques

T1056.001KeyloggingEvidence1

The original class identifiers reflect the malware's core capabilities: ... LiveKeysStrok - keylogging

T1056.003Web Portal CaptureEvidence1

Webjector - web injection / phishing overlays

T1113Screen CaptureEvidence1

ScreenCaps - screen capture

T1125Video CaptureEvidence1

CameraCap - camera access

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers... Starting from two IPs named in a June 2026 Chinese state media notice, we pivoted on Let's Encrypt certificate subjects and an AdminPro panel fingerprint ... to identify 170 active servers

T1219Remote Access ToolsEvidence1

Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNs ... trace a leaked Android RAT framework across 170 active servers ... and document a successor platform called Night Dragon targeting Chinese users.

INDICATORS OF COMPROMISE

IOCs tracked for this family

24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

16 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

reddit netsecNews

Jul 28, 2026

Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNs : r/netsec

An Android remote access trojan framework traced across 170 active servers. The reporting describes leaked framework/source components, APK builder internals, panel fingerprints, and associated server infrastructure.

huntio blogNews

Jul 28, 2026

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

An Android malware framework combining APK generation and a full-featured device-control panel. It builds customized malicious APKs with phishing overlays, keylogging, screen capture, camera access, accessibility-service abuse, web injection, and encrypted C2 callbacks, primarily for financially motivated fraud.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching24

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Flying Eagle

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Flying Eagle combines APK generation and full-featured C2 device management in a single panel... remote communications over WebSocket and Firebase.

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence1

The files share several core behaviors with modern builds linked to the RAT, notably Accessibility Service-based privilege escalation, gesture injection via dispatchGesture...

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

The files share several core behaviors with modern builds linked to the RAT, notably Accessibility Service-based privilege escalation, gesture injection via dispatchGesture...

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app.

Credential Access

3 techniques

T1056.001KeyloggingEvidence1

The original class identifiers reflect the malware's core capabilities: ... LiveKeysStrok - keylogging

T1056.003Web Portal CaptureEvidence1

Webjector - web injection / phishing overlays

T1649Steal or Forge Authentication CertificatesEvidence1

The announcement describes it as compatible with all devices, and features including password capture for financial applications (Alipay, WeChat, banking apps)...

Collection

4 techniques

T1056.001KeyloggingEvidence1

The original class identifiers reflect the malware's core capabilities: ... LiveKeysStrok - keylogging

T1056.003Web Portal CaptureEvidence1

Webjector - web injection / phishing overlays

T1113Screen CaptureEvidence1

ScreenCaps - screen capture

T1125Video CaptureEvidence1

CameraCap - camera access

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

T1219Remote Access ToolsEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

16 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

reddit netsecNews

Jul 28, 2026

Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNs : r/netsec

huntio blogNews

Jul 28, 2026

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching24

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.