Flying Eagle Android RAT: Leaked Source Code, 170 Servers, and a Successor Called Night Dragon
Flying Eagle Android RAT: Leaked Source Code, 170 Servers, and a Successor Called Night Dragon Source: https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
Flying Eagle Android RAT: Leaked Source Code, 170 Servers, and a Successor Called Night Dragon
Description
Flying Eagle Android RAT: Leaked Source Code, 170 Servers, and a Successor Called Night Dragon Source: https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
Reddit Discussion
A fake Public Security Bureau app led to Flying Eagle, a Chinese Android RAT framework we tracked across 170 active servers using TLS certificate pivots and panel fingerprints. Post includes HuntSQL queries, full IOC tables, APK builder analysis (package randomization, AES-encrypted C2 URLs, asset padding for AV evasion), and a timeline of the criminal ecosystem behind it. A likely successor called Night Dragon was introduced June 23, version 2 already in development.
IOCs, fingerprints, and detection artifacts in the full report:
https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
Links cited in this discussion
Technical Details
- Source Type
- Subreddit
- blueteamsec+AskNetsec+Information_Security
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":33,"reasons":["external_link","newsworthy_keywords:rce,leaked","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":["rce","leaked"],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a68ec439c2644c7f8faa7f7
Added to database: 07/28/2026, 17:52:03 UTC
Last updated: 07/29/2026, 02:52:02 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.