Flying Eagle Android RAT: Leaked Source Code, 170 Servers, and a Successor Called Night Dragon

A fake Public Security Bureau app led to Flying Eagle, a Chinese Android RAT framework we tracked across 170 active servers using TLS certificate pivots and panel fingerprints. Post includes HuntSQL queries, full IOC tables, APK builder analysis (package randomization, AES-encrypted C2 URLs, asset padding for AV evasion), and a timeline of the criminal ecosystem behind it. A likely successor called Night Dragon was introduced June 23, version 2 already in development.

IOCs, fingerprints, and detection artifacts in the full report:
https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon