Full Report
Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public Security service application targeting Android users in China. The kit supports payment-password
Analysis Summary
# Tool/Technique: Flying Eagle (Android RAT Framework)
## Overview
Flying Eagle is a comprehensive Android Remote Access Trojan (RAT) and builder framework currently circulating in cybercriminal circles. It enables attackers to create malicious Android applications (APKs) that masquerade as legitimate services—most notably government and public security apps—to steal financial data, monitor user activity, and maintain persistent remote control over infected devices.
## Technical Details
- **Type:** Malware Framework / Remote Access Trojan (RAT)
- **Platform:** Android
- **Capabilities:** Keystroke capture, screen recording, camera access, phishing, and payment credential theft.
- **First Seen:** Public reporting emerged in June/July 2026.
## MITRE ATT&CK Mapping
- **[TA0031 - Network Effects]**
- **[T1469 - Credential API Capable]**: Capturing payment passwords.
- **[TA0033 - Collection]**
- **[T1513 - Screen Capture]**: Recording device screens.
- **[T1430 - Location Tracking]**: General surveillance of device state.
- **[TA0030 - Credential Access]**
- **[T1417 - Input Capture]**: Keylogging and gesture injection.
- **[TA0037 - Persistence]**
- **[T1546.002 - Event Triggered Execution: Accessibility Service]**: Leveraging accessibility permissions to maintain control and bypass security prompts.
## Functionality
### Core Capabilities
- **Automated Builder:** A Docker-based deployment (NGINX, PHP, MySQL, Node.js) that allows operators to generate custom APKs with chosen icons, names, and C2 configurations.
- **Remote Control:** Full access to device cameras and microphones.
- **Data Exfiltration:** Captures keystrokes (keylogging) and records screens to harvest sensitive information.
- **Communication:** Uses WebSockets for real-time interaction between the control panel and the infected device.
### Advanced Features
- **Evasion Techniques:** The builder adds 2.8 MB to 3.5 MB of low-entropy JSON padding (junk data) to the APK to mimic legitimate SDK configurations and bypass simple size-based detection.
- **Obfuscation:** Encrypts embedded command-and-control (C2) URLs using AES-128-CBC and randomizes package/class names during the build process.
- **Accessibility Service Exploitation:** Uses Android’s Accessibility Services for gesture injection and privilege escalation, allowing the malware to interact with other apps without user consent.
## Indicators of Compromise
- **File Names:** `中国龙.zip` (Chinese Dragon), `公安一网通办` (Fake Public Security App).
- **Network Indicators:**
- `110gongan[.]com`
- `207.56.30[.]188`
- **Behavioral Indicators:**
- Rapid requests for Accessibility Service permissions upon installation.
- Unexpected HTTP 302 redirects to admin panels.
- Outbound WebSocket traffic to non-standard ports or suspicious IP addresses.
## Associated Threat Actors
- **Distributors:** Telegram channels `SQLRCE0` and `Yx Technology`.
- **Targeting:** Primarily Chinese-speaking Android users through localized social engineering lures.
## Detection Methods
- **Signature-based:** Many Flying Eagle samples are identified by antivirus engines as variants of the **SpyNote** malware family.
- **System Monitoring:** Detecting the abuse of `Accessibility Services` by apps that do not have a functional need for them.
- **File Analysis:** Scanning for high-volume, low-entropy JSON padding within APK files.
## Mitigation Strategies
- **App Governance:** Only download applications from official app stores (e.g., Google Play Storage or official manufacturer stores).
- **Permission Management:** Deny "Accessibility Service" requests to any application that does not have a clear, legitimate reason for using them.
- **User Education:** Advise users to be skeptical of government or financial service apps distributed via SMS, Telegram, or third-party websites.
- **Device Remediation:** If infected, freeze all payment channels (bank accounts/mobile wallets), perform a factory reset, and change all account passwords.
## Related Tools/Techniques
- **SpyNote:** The underlying codebase for many Flying Eagle samples.
- **Night Dragon (2026):** A separate Android control kit promoted by the same distributors (not to be confused with the 2011 espionage campaign).
- **Phishing Templates:** Included in the framework for financial, adult, and government-themed social engineering.