# Flying Eagle's Source Code Is in the Wild. Here Come the Copycats.
The malware itself was bad. The leak is worse.
Source code for Flying Eagle — an Android remote access trojan framework sophisticated enough to impersonate Chinese government infrastructure — is now circulating freely through criminal Telegram channels. Researchers at Hunt.io and independent analyst NetAskari have already traced the framework's fingerprints across 170 internet-facing servers. The RAT is active. The blueprint is public. And the gap between those two facts is where the real danger lives.
---
## A Government Mask on a Thieves' Tool
The lure application Flying Eagle has been deploying presents itself as "公安一网通办" — China's legitimate unified public security service platform, a real government portal that citizens use to handle administrative tasks ranging from household registration to travel permits. This is not generic phishing bait. Whoever built Flying Eagle understood their target audience well enough to clone a service people genuinely trust and interact with regularly.
Impersonating government apps is a calculated move. Unlike spoofed banking apps, where users are trained to be suspicious, a public security portal carries an implicit authority that disarms scrutiny. If anything, you'd expect it to request elevated permissions. You'd expect it to need your credentials. The social engineering here is embedded in the premise before the malware has done a single thing.
The app harvests what you'd expect from a payment-capable RAT: credentials, payment card details, SMS intercepts for two-factor bypass. But the delivery mechanism — a state service clone — is the part that deserves more attention than it's getting.
---
## 170 Servers and What That Footprint Tells You
Hunt.io and NetAskari didn't just find the malware. They traced matching control panels and TLS certificates to 170 internet-facing servers. That number requires unpacking.
A coordinated botnet with centralized command infrastructure often looks like a few dozen C2 nodes, many of them deliberately ephemeral. 170 servers with consistent certificate patterns suggests something different: either a franchise model where the framework has been distributed to multiple operators running independent campaigns, or an exceptionally well-resourced single actor who has built redundancy into the architecture from the start.
Given that the source code is now in criminal hands on Telegram, the franchise explanation looks increasingly likely. What Hunt.io and NetAskari mapped may represent the original campaign. The derived campaigns — spun up by anyone who downloaded the kit and stood up their own panel — haven't been catalogued yet.
Certificate matching is one of the most reliable ways to track malware infrastructure at scale, and it's exactly the right method here. When operators reuse the same certificate generation tooling, signing parameters, or self-signed cert templates across deployments, they leave a thread that researchers can pull. The fact that 170 servers shared identifiable certificate characteristics suggests the Flying Eagle framework includes infrastructure setup tooling — making it easier to deploy at scale, and easier to fingerprint at scale.
---
## Source Code in the Wild Changes Everything
There is a meaningful difference between active malware and malware whose source code has leaked.
Active malware can be analyzed, signatures written, infrastructure blocked. The threat evolves, but it evolves from a fixed codebase. When source code enters criminal ecosystems, the threat forks. We have seen this pattern repeatedly.
AndroRAT's 2012 public release didn't end Android RAT development — it accelerated it, spawning dozens of derivatives that retained the core functionality while swapping out detection surfaces. SpyNote's source code leak produced a wave of rebadged variants that challenged defenders precisely because they shared behavioral DNA with the original but differed enough to evade static signatures. The Mirai source code release in 2016 is the canonical example: a single IoT botnet became the template for an entire generation of infrastructure-targeting malware.
Flying Eagle entering this category is a concrete escalation. Operators who lacked the technical depth to build an Android RAT from scratch now have a working framework with infrastructure setup tooling, a government-app lure, and a 170-server proof-of-concept that it operates at scale. The next wave of campaigns using this code may not target China at all. The impersonation template is portable. Any government service application with a plausible-enough skin and a credible enough distribution channel works the same way.
---
## What Defenders Are Actually Watching For
For Android security teams and enterprise mobile device management administrators, the indicators worth tracking:
Certificate patterns. Hunt.io's methodology — matching TLS certificates across the 170-server infrastructure — is directly reproducible for organizations running their own threat intelligence. The certificate fingerprints from identified Flying Eagle C2 nodes should be in your blocklists now.
Sideloaded APKs requesting SMS permissions. Flying Eagle's payment-credential harvesting depends heavily on SMS intercept for OTP bypass. An Android application distributed outside the Play Store that requests SMS_READ permissions and presents as a government or financial service should trigger immediate review.
Government service impersonation at the app layer. The "公安一网通办" template is specific to China, but the pattern — a trusted public-sector app clone used as a RAT delivery vehicle — will be replicated in other regions with their own equivalents. The UK's HMRC, India's DigiLocker, any national digital identity service: all viable targets for the same approach with localized branding.
Telegram-distributed crimeware toolkits. Criminal Telegram channels as a distribution vector for RAT source code is a structural trend, not an anomaly. Organizations with visibility into these channels — directly or through threat intel feeds — have lead time before derived campaigns operationalize.
---
## HackWire Analysis
Flying Eagle is being covered as an Android RAT story. It should be covered as a crimeware proliferation story.
The 170-server infrastructure is significant. The source code leak is the actual event.
When malware frameworks enter open criminal distribution — especially frameworks that include built-in infrastructure tooling and working social engineering templates — the original campaign becomes a footnote. What matters is the derivative wave. SpyNote is instructive here: after its code leaked in 2022, Zimperium documented a surge in SpyNote-derived samples across 2022 and 2023, targeting financial institutions across Europe and Southeast Asia. The variants kept the core credential-stealing functionality while adding new persistence mechanisms and swapping out the C2 architecture. Defenders who were blocking the original struggled with the forks.
Flying Eagle is entering the same trajectory. The government-app impersonation angle is a higher-sophistication starting point than most leaked RAT frameworks offer, which means derivative campaigns will inherit a lure that actually works. Security teams focused narrowly on the 170 identified servers are solving last month's problem.
The right response is building detection capability against the behavioral patterns — SMS intercept, elevated permission requests from sideloaded APKs, certificate patterns from the identified infrastructure — rather than treating this as a fixed target. It isn't anymore.
— HackWire Editorial
---
## Related Coverage