Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers linked to the Flying Eagle Android remote access trojan (RAT) framework, according to joint research published July 28.
Flying Eagle's capabilities and the builder that produces it
The Flying Eagle toolkit is both a builder and a control framework for Android crimeware. The published code supports payment-password and keystroke capture, screen recording, camera access, and phishing prompts that impersonate financial, adult‑content, and government‑service applications. The panel lets an operator choose an app name, icon, lure text, and command‑and‑control (C2) address, then produces a signed APK from one of two templates. The builder randomises package and class names, encrypts embedded C2 URLs using AES‑128‑CBC, and pads builds with 2.8 MB to 3.5 MB of low‑entropy JSON designed to resemble legitimate SDK configuration data.
Hunt.io reported that samples generated by the builder were detected as SpyNote and that those samples used Android accessibility services for privilege escalation and gesture injection.
Telemetry: 170 servers traced, and what that number means
Hunt.io's search of the preceding 30 days found infrastructure fingerprints on 170 servers. Researchers identified 158 servers through the presence of an AdminPro page title, HTTPS redirect behavior, and matching response headers, and they located 12 additional servers by matching a default TLS certificate packaged with the Flying Eagle code. The report explicitly notes that the count does not establish 170 infected phones, victims, operators, or confirmed C2 systems; it documents infrastructure fingerprints only.
Source-code circulation, the 中国龙.zip package, and Telegram distribution
The Flying Eagle source code is circulating through criminal Telegram channels, the researchers found. The code was distributed as a 388 MB archive named 中国龙.zip (Chinese Dragon) that contains a full Docker deployment with nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default TLS certificate. Two Telegram channels observed by the researchers — SQLRCE0 and Yx Technology — were distributing modified versions of the framework.
Messages reviewed by Hunt.io and NetAskari claimed an unidentified party had compromised customer infrastructure containing 189 Flying Eagle servers and exfiltrated database data; those claims have not been independently confirmed. Yx Technology also advertised cash‑out services charging 20% to 50% of the transaction value.
Night Dragon, SQLRCE0 activity, and the distinction the researchers made
On June 23, 2026, SQLRCE0 introduced a separate Android control kit called Night Dragon. Researchers found two associated servers and an exposed panel that listed 46 devices as online and 29 as actively connected, but they said they could not determine whether those entries represented victims or test data. Hunt.io characterized Night Dragon as appearing to be an independent build, with a second version under development as of July 12. The report further states that this 2026 Night Dragon is financially motivated Android crimeware and is not the 2011 campaign McAfee named Night Dragon.
China's warnings and recommended actions
Chinese authorities advised anyone who installed the fraudulent "公安一网通办" application to remove it, scan the device, change affected account passwords, freeze payment channels if funds moved, and report the incident to police. China's National Cybersecurity Notification Center warned on June 18 that the fake application was being distributed from 110gongan[.]com, associated with 207.56.30[.]188, and that it could steal payment data and remotely control devices.
What this means for security teams, end users, and criminal operators
- Security teams and technologists: Hunt.io's indicators — AdminPro page title, HTTPS redirect behavior, matching response headers, and the default TLS certificate — provide concrete fingerprints to hunt for on networks and in external scanning. The builder's use of AES‑128‑CBC for embedded C2 URLs and the large low‑entropy JSON padding are additional technical artifacts teams can look for when triaging APKs and server responses.
- End users and consumers in China: Chinese authorities' guidance is direct — remove the fraudulent app, scan the device, change impacted account passwords, freeze payment channels if funds moved, and report incidents to police.
- Criminal operators and monetizers: The Telegram channels observed are marketing modified frameworks and cash‑out services; advertised rates of 20% to 50% of transaction value indicate an active monetization market around these kits.
The record published July 28 documents both active distribution of Flying Eagle's source code and infrastructure fingerprints tied to 170 servers, but it does not establish causation between the two. Researchers and authorities have identified operational artifacts and a packaged deployment that make the toolkit usable out of the box; whether the traced servers represent active C2, staging, testing, or unrelated instances remains an open practical question for ongoing analysis and enforcement.
