Threat Actor ๐จ๐ณ China
Night Dragon
Also known as: G0014
Indicators of Compromise 36
Domain 110gongan[.]com Domain alcs[.]xyttkx[.]cc Domain fusu[.]us[.]ci Domain h5[.]xyttkx[.]cc Domain ls[.]j2x8a[.]top Domain s[.]orove[.]cn Domain txl[.]xyttkx[.]cc Filename ApkBuilder.php Filename Chinese Dragon Filename Eaod29251.php Filename Eaod85401.php Filename EaodWorker.exe Filename SECRIT_KEY Filename ไธญๅฝ้พ.zip GitHub Repo SQLRCE0 GitHub Repo Yx Technology GitHub Repo ไธญๅฝ้พ.zip GitHub Repo ้ฃ้นฐๆงๆๅ
.zip SHA-256 0376db397807c1f1e32a99a9db622f35f4fe5597bd05b4fd5e93117062e0131f SHA-256 1456f31bf6b5d4ade90fe080006478133296080353bf69c1819fa9b766e7f57a SHA-256 4395db6ad53a415532673b16f5b64207d53cecc5b15a736c038cf3890368a164 SHA-256 5dee5cde6f2874c582effe302960b21569ee007e9e0cd4f7499d418cceb9095b SHA-256 773c77494d6321e4e449c9558c7915166bcb6c05e3c42a9d30e5eac4db8ee0df SHA-256 82520e6aa6194b2de0b1c404805a5da7d3693acab8f7ae2dd5104f14baf82cd7 SHA-256 b803cd5032dc1abd7aabc45c8cadc471c8a59872a95d48807f13e230c58230f3 SHA-256 c692ad120cc90548d48dbe57d006f2403c49833b8993af3c38fe031eb39999bd SHA-256 d8a82d7b4457352774772bfac094127d7f67526ae7011d838cc3f7ccc15fd86e SHA-512 7fe8d14e7a9cda92c79d5ae836ed95d772bcc853079c4020c5213c3894c7f7af IP 108[.]187[.]7[.]66 IP 108[.]187[.]7[.]71 IP 154[.]44[.]25[.]12 IP 207[.]56[.]30[.]188 IP 207[.]56[.]30[.]194 IP 77[.]105[.]161[.]235 IP 85[.]137[.]253[.]48 Package com.icontrol.protector
MITRE ATT&CK TTPs 7
T1003 T1059 T1059.001 T1071.001 T1133 T1212 T1484.001
OS Credential Dumping
Credential Access
Command and Scripting Interpreter
Execution
PowerShell
Execution
Web Protocols
Command And Control
External Remote Services
Persistence
Exploitation for Credential Access
Credential Access
Group Policy Modification
Defense Evasion
Source Articles
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
The article details the discovery and analysis of a malicious Android Remote Access Tool (RAT) framework called Flying Eagle, which was leaked in early 2026 and has since been widely distributed by cybercriminal actors. The malware is distributed via fake apps impersonating Chinese government services and includes capabilities for credential theft, keylogging, screen capture, and phishing overlays. At least 170 active servers hosting the Flying Eagle infrastructure were identified, primarily in Hong Kong, using shared codebases and panel fingerprints. A new successor platform named Night Dragon has emerged, developed by the threat actor behind the @SQLRCE0 Telegram channel, indicating ongoing evolution of this mobile threat ecosystem.
static-urls
Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
The source code for the Flying Eagle Android remote access trojan (RAT) is circulating in criminal Telegram channels, enabling widespread deployment of the malware. Researchers identified infrastructure linked to 170 servers hosting control panels or certificates associated with the RAT, which is used in a fake Chinese Public Security app called 'ๅ
ฌๅฎไธ็ฝ้ๅ'. The malware can steal payment credentials, record screens, access cameras, and perform phishing attacks on financial and government apps. A second Android RAT, Night Dragon, was introduced by one of the same Telegram groups, though it appears to be a separate build with no shared code with Flying Eagle.
hacker-news ยท1mo ago