Executive Summary
Research has uncovered a fractured but active China-nexus criminal ecosystem centered around the 'Flying Eagle' (飞鹰) Android RAT and its newly developed successor, 'Night Dragon' (夜龙). Initially identified through a fraudulent Chinese Provincial Public Security Bureau application, the investigation revealed 170 active C2 servers. The ecosystem is fueled by leaked source code and operational support provided via Telegram channels like SQLRCE0 and Yx Technology, which offer 'fixed' builds and cash-out services for stolen credentials.
Technically, the framework utilizes sophisticated APK generation scripts that automate package name randomization, class obfuscation, and entropy reduction to evade antivirus detection. The malware leverages Android Accessibility Services for privilege escalation, gesture injection, and full device control, including screen capture and keylogging. Infrastructure is heavily concentrated in Hong Kong-based providers like Zillion Network Inc. and Antbox Networks Limited.
This threat poses significant risk to financial institutions and individual users, as the malware includes dedicated phishing overlays for major Chinese banks, Alipay, WeChat, and cryptocurrency wallets. While currently focused on Chinese users, the presence of international templates and the rapid development of Night Dragon V2 suggest a potential for broader geographic expansion.