Flying Eagle Android RAT Source Code Leaks to Telegram

Source code for the Flying Eagle Android remote access trojan is circulating on criminal Telegram channels. Hunt.io and independent researcher NetAskari traced the RAT’s control panels and TLS certificates to 170 internet-exposed servers and linked the framework to a fake “公安一网通办” (Unified Public Security) application targeting Android users in China. The kit’s documented capability set includes payment-password theft.

What’s different now

An active campaign with 170 known servers is a tracking problem. Source code on Telegram is a proliferation problem.

The original campaign has a narrow target profile: Chinese Android users deceived into sideloading an app impersonating a government service. Detection rules and IOCs tied to that campaign’s panel paths, certificate fingerprints, and C2 patterns are built around that profile. Once the source code is freely available, none of that profile has to hold. New operators can change the lure, retool the C2, and target a different geography entirely — and the signatures written for the original campaign won’t follow them.

The 170 servers Hunt.io identified are associated with the original campaign. Assume they’re already in threat intel feeds. The exposure to watch for is what gets built next.

Concrete steps

• Close the sideload gap in MDM. Flying Eagle’s distribution relied on APK installation outside Google Play — users were prompted to enable “Unknown sources.” If your mobile device management policy still permits that, change it today. Play Protect doesn’t cover apps that never touched Play.

• Audit dangerous permission requests. The original variant requested permissions consistent with credential and payment-data access — accessibility services, device admin, SMS read. Verify your MDM flags or blocks apps requesting that combination from unverified publishers.

• Hunt the published IOCs. Hunt.io released certificate fingerprints and panel infrastructure for the 170 observed servers. Run them against DNS logs, proxy traffic, and any NDR tooling you have. Not because those servers are where future attacks will live, but because you want to confirm none of your managed devices already reached them.

• Check for Android RAT detection gaps. Some mobile threat defense platforms rely heavily on static signatures. If yours does, verify it has coverage for dynamically loaded code — a standard evasion in Android RAT kits distributed as source.

No Western enterprise victims appear in the current research. That’s a “not yet” rather than a clean bill. Android malware-as-a-service kits have a short lead time from source release to active campaigns. Prioritize the MDM policy check first; everything else is monitoring.