Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged Learn More Hunt.io Product Features OEM Pricing About Blog Login Get a Demo To embed a website or widget, add it to the properties panel. Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged Learn More Hunt.io Product Features OEM Pricing About Blog Login Get a Demo To embed a website or widget, add it to the properties panel. Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged Learn More Hunt.io To embed a website or widget, add it to the properties panel. Home Blog Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon Published on Jul 28, 2026 TABLE OF CONTENTS Key Findings Initial Infrastructure Analysis Inside the Flying Eagle Framework Expanding the Network Infrastructure A look into China-Nexus Mobile Cybercriminal Systems Night Dragon: A Mobile RAT Successor? Indicators of Compromise Conclusion Note: This report is the result of a collaborative investigation between the Hunt.io research team and NetAskari , an independent journalist and researcher specializing in Chinese cyber operations and online surveillance. While conducting routine open-source research, NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app. Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase. Key Findings A fake Public Security Bureau app distributed via attacker-controlled domains was the entry point, confirmed in a June 2026 Chinese state media notice warning citizens of fraudulent applications disguised as official government services. Flying Eagle combines APK generation and full-featured C2 device management in a single panel, with phishing overlays for financial, adult, and government service apps The source code was stolen in early 2026, along with nearly 200 customer databases, leading to multiple modified variants circulating across criminal actors At least two Telegram channels, SQLRCE0 and Yx科技, are distributing patched versions of the leaked codebase with operational support and cash-out services Telegram channel messages reference international templates, suggesting targeting beyond Chinese users is possible A likely successor platform called Night Dragon (夜龙) was introduced by SQLRCE0 on June 23, 2026, with version 2 already in development The investigation that follows traces how a set of shared indicators led to a broader view of the infrastructure supporting this activity. Initial Infrastructure Analysis The indicators highlighted in the public notice included two IP addresses, 207.56.30[.]188 and 207.56.30[.]194, in addition to several resolving domains. Both servers are hosted on AS54801 (Zillon Network Inc.) in Hong Kong. During our analysis, it was identified that 207.56.30[.]194 hosted Let's Encrypt TLS certificates for three domains across overlapping timeframes: fusu.us[.]ci, 110gongan[.]com, and ls.j2x8a[.]top. The certificates were rotated on almost a monthly basis. Figure 01: Hunt.io IP intelligence pivot data for 207.56.30[.]194 IP intelligence data indicated pivots available on the ls.j2x8a[.]top certificate subject, returning two additional servers in HuntSQL : 108.187.7[.]66 and 108.187.7[.]71, both hosted on AS138995 (Antbox Networks Limited), also located in Hong Kong. Query: SELECT * FROM ip WHERE tls.cert.subject.common_name = 'ls.j2x8a.top' Copy Example Output: Figure 02: HuntSQL results showing two additional IPs hosted on Antbox Networks Limited The new IPs hosted a Chinese-language login panel on port 443 with the page title "阿力科技" and a login route at /login?redirect=list/basic-list. A separate login panel on port 80 of 207.56.30[.]194 titled APK Confusion Manager (APK 混淆管理后台) differed in structure and styling suggesting the two are distinct applications. The confusion manager's relationship to this campaign remains unclear at this time. Figure 03: Login panel hosted at ls.j2x8a[.]top Inside the Flying Eagle Framework The source code, distributed via the Telegram channel Yx科技 (English: Yx Technology) consists of a 388 MB archive labeled 中国龙.zip (Chinese Dragon). The ZIP contains a full Docker deployment; nginx web server, PHP, MySQL, and a Node.js WebSocket server. Also included are APK build tools, phishing templates, and a default TLS certificate. Figure 04: APK generation page in a local test instance The Docker image bundles Java 11 and Android SDK build tools, allowing users to create customized apps. The APK generation module accepts user-defined lured text, application names, icons, and C2 callback addresses, then builds a signed APK using one of two base templates. Additional observed templates: Chinese adult streaming services, TikTok, financial applications, and landing pages for public welfare projects that send the number of visits and downloads back to the operator. To obtain a better understanding of how the program works, and to identify additional network indicators, we decided to stand up a test instance of Flying Eagle in an isolated environment. Upon install completion, a login panel is available at localhost/login?redirect=/basic. Before the operator-customized page renders, the page briefly presents a title of "AdminPro." This was also observed on the page identified in the previous section. Figure 05: Test login page for Flying Eagle. ApkBuilder.php The APK build process revealed several features designed to make each generated sample unique and resistant to static detection. The script replaces the hardcoded package name, com.icontrol.protector with a randomly generated alternative constructed from legitimate sounding segments (e.g., com.cloud.manager.core). Easily detected class names are renamed with 8-14 character randomized strings. The original class identifiers reflect the malware's core capabilities: RecordPayPassword - payment credential capture LiveKeysStrok - keylogging ScreenCaps - screen capture Webjector - web injection / phishing overlays AccessibilityActivity - accessibility service abuse CameraCap - camera access C2 callback URLs embedded in each APK are encrypted using AES-128-CBC with hardcoded default IV, password, and salt derived through PBKDF2-SHA1 with 65,536 iterations. Source code comments note the above values maintain compatibility with the original Windows .NET binary (EaodWorker.exe), indicating the Docker version is a direct port. Malicious samples generated by the builder, including the 110gongan[.]com APK and base templates found under /user/apps/ in the archive, are detected by sandboxes as SpyNote Android malware. The files share several core behaviors with modern builds linked to the RAT, notably Accessibility Service-based privilege escalation, gesture injection via dispatchGesture, and remote communications over WebSocket and Firebase. To further evade AV detection, the builder injects 2.8-3.5 MB of structured JSON files into the APK's assets directory. Rather than using random bytes which can trigger heuristics scanners, the script uses padding consisting of Base64-encoded values posing as SDK configuration caches. The developer left a comment noting as much that the reduced entropy avoids triggering antivirus alerts while resembling legitimate data. Figure 06: Snippet of the ApkBuilder.php script showing the naming pattern and URL encryption Connecting the 110gongan[.]com Sample A comparison of the malicious APK referenced in the security notice showed multiple structural overlaps with the above generation process: Identical numbered .bt asset architecture, identical asset directory layout, matching four-DEX structure, and the same style of packed and encoded resources. The malware was hosted via the attacker-controlled domain, 110gongan[.]com. GongAn is Pinyin for "Public Security," and is an abbreviation for Provincial Public Security Bureaus in China. A hardcoded C2 domain, fusu666[.]cc which resolves to 207.56.30[.]188 presented a login panel branded with Yx科技 (Yx Technology), which led us to their Telegram channel. Figure 07: Login page hosted at fusu666[.]cc, including Yx科技 (YxTechnology) in the upper right corner. TLS Certificate A TLS certificate included in the archive's docker/ssl directory was issued by Let's Encrypt for the domain alcs.xyttkx[.]cc. The fields and values are below: Field Value Subject CN alcs.xyttkx[.]cc Issuer Let's Encrypt R13 Seria 06:E5:4E:95:28:F4:F8:CF:EB:DC:48:6D:78:C6:5B:46:21:2E Valid 2026-04-07 to 2026-07-06 SHA-1 AB:42:24:A6:36:1E:6F:82:6F:DB:26:22:76:41:1E:03:F8:17:7E:30 Key RSA 2048 Table 01: Default TLS certificate details packaged with Flying Eagle installs A HuntSQL search for servers hosting certificates using xyttkx[.]cc returned additional subdomains: txl.xyttkx[.]cc, h5.xyttkx[.]cc, and alcs.xyttkx[.]cc across 12 IPs over the past 30 days. The servers also presented login pages matching the AdminPro template and route structure described previously. The webpage title and HTTP response and default certificate provided two independent fingerprints for identifying additional infrastructure. Query: SELECT * FROM ip WHERE tls.cert.subject.common_name LIKE '%xyttkx.cc%' AND timestamp > NOW - 30 DAY Copy Example Output: Figure 08: HuntSQL results showing hosts using similar certificates as the default, xyttkx[.]cc Expanding the Network Infrastructure We crafted two HuntSQL queries to look for similar login panels matching the AdminPro title, and those using the