Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNs

July 28, 2026 Yanac

Joint investigation with NetAskari. Starting from two IPs named in a June 2026 Chinese state media notice, we pivoted on Let’s Encrypt certificate subjects and an AdminPro panel fingerprint (302 to HTTPS, Strict-Transport-Security: max-age=31536000, /login?redirect=list/basic-list route) to identify 170 active servers, concentrated across Antbox Networks Limited, Cognetcloud, CTG Server Limited, and Zillion Network Inc. in Hong Kong. A misspelled environment variable (SECRIT_KEY) in the source archive led to an open directory with a Windows XAMPP deployment of the same codebase. HuntSQL queries, full IOC tables, and APK builder analysis included: https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon submitted by /u/Straight-Practice-99 [link] [comments]Technical Information Security Content & DiscussionRead More