Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates

Flying Eagle RAT: Source Code Leak Fuels Rapid Proliferation

Security researchers at Hunt.io, working alongside independent researcher NetAskari, have uncovered an alarming proliferation of the Flying Eagle Android remote access trojan (RAT) framework. Matching control panels and SSL certificates have been traced to more than 170 internet-exposed servers, while the framework's source code circulates openly through criminal Telegram channels — dramatically lowering the barrier to entry for threat actors.

By the Numbers

What Is Flying Eagle?

Flying Eagle is a full-featured Android RAT framework designed to give attackers covert remote control over compromised Android devices. Once deployed, the RAT enables operators to:

• Intercept SMS messages (including OTP/2FA codes)
• Access contacts, call logs, and location data
• Record audio and capture camera feeds
• Exfiltrate files and installed application data
• Execute commands remotely without victim awareness

The framework is built around a web-based control panel — the instances of which are now being actively mapped by the security research community through matching certificates and infrastructure fingerprints.

The Government App Impersonation Campaign

Researchers linked the Flying Eagle infrastructure to a fake government application impersonation campaign. The Chinese-language lure translates to "公安一网通办" (Public Security One-Stop Service), mimicking a legitimate Chinese government administrative portal.

This social engineering approach is highly effective: victims are convinced they are installing an official government app, granting it the extensive permissions requested during install without suspicion. The permissions that appear legitimate for a government service — contacts, SMS, location, camera — are exactly what the RAT requires for full device surveillance.

Victim flow:
1. Victim receives link or message directing to fake government app
2. Victim installs APK (sideloaded — bypasses Play Store)
3. App requests permissions disguised as government service requirements
4. RAT establishes C2 connection to attacker-controlled server
5. Attacker gains silent persistent access to device

Source Code Circulation and Threat Multiplication

The most alarming aspect of this disclosure is the free circulation of Flying Eagle's source code through criminal Telegram channels. This transforms the threat landscape:

When mature RAT source code leaks, researchers typically observe:

1. Rapid diversification of C2 infrastructure by new actors
2. Modified variants that evade existing detection signatures
3. Increased targeting breadth as barriers to entry collapse
4. Commoditization — the tool appears in crime-as-a-service offerings

Infrastructure Discovery Methodology

Hunt.io's discovery demonstrates the value of internet-wide scanning and certificate correlation in tracking mobile malware infrastructure:

Discovery chain:
1. Passive DNS and internet scan data identifies candidate hosts
2. SSL/TLS certificate fingerprints match across 170+ hosts
3. Web control panel signatures confirm Flying Eagle deployment
4. IP geolocation and ASN data maps the infrastructure footprint
5. Certificate timeline analysis reveals deployment history

This methodology — identifying C2 infrastructure through passive observables rather than malware samples — allows researchers to map threats at scale and proactively block malicious infrastructure before samples are even captured from victims.

Detection and Protection

For Organizations and Security Teams

• Block known IOCs: Add Hunt.io and NetAskari's published IP ranges and certificate fingerprints to threat intelligence feeds
• Mobile device management (MDM): Enforce policies preventing sideloading of APKs from unknown sources
• Network monitoring: Watch for Android devices connecting to suspicious overseas infrastructure on non-standard ports
• User awareness: Train users to install apps only from official app stores (Google Play)

For Individuals

1. Never install APKs from outside the Google Play Store, especially from links received via SMS or messaging apps
2. Be suspicious of apps requesting SMS, contacts, camera, and location simultaneously — even if they appear to be government services
3. Verify app authenticity through official government websites before installation
4. Use Google Play Protect and ensure it is enabled on all Android devices
5. Report suspicious apps to Google and local law enforcement

Indicators of Compromise (IOCs)

Why This Matters

The Flying Eagle disclosure is a case study in how source code leaks accelerate the threat ecosystem. What was once a specialized RAT operated by a focused threat actor is now a commodity tool available to any Telegram user with malicious intent. The 170 servers already identified represent only the traceable infrastructure — actors using the leaked code with fresh infrastructure will not appear in these searches.

For security teams, this underscores:

• The critical importance of mobile threat intelligence alongside traditional endpoint and network monitoring
• The value of passive DNS and certificate fingerprinting in mapping malware infrastructure
• The multiplier effect of source code leaks — a single disclosure can spawn dozens of independent campaigns

References

• The Hacker News — Flying Eagle Android RAT Traces Found on 170 Servers
• Hunt.io Threat Intelligence

Related Reading

• OpenAI Agent Escaped Sandbox, Compromised Hugging Face Production