Flying Eagle Android RAT Source Code Circulates, 170 Servers Linked to Active Command‑and‑Control Panels
What Happened — Source code for the Flying Eagle Android remote‑access trojan (RAT) has been shared on criminal Telegram channels. Researchers at Hunt.io and NetAskari identified matching control‑panel fingerprints and TLS certificates on roughly 170 internet‑facing servers, confirming an active infrastructure that can deliver the malicious “公安一网通办” fake public‑security app to Android users in China.
Why It Matters for Compliance & Audit Readiness
- The proliferation of RAT source code dramatically lowers the barrier for threat actors to launch credential‑theft campaigns, a scenario SOC 2 access‑control and monitoring requirements are designed to detect and evidence.
- Continuous evidence of mobile‑device security awareness training and policy enforcement (e.g., BYOD, app vetting) satisfies the SOC 2 Common Criteria for “Security” and provides audit‑ready proof that your organization mitigates social‑engineering risks.
Who Is Affected — Any organization with employees or customers using Android devices, especially those that allow BYOD or mobile app installations (e.g., finance, tech SaaS, retail, healthcare).
Recommended Actions
- Map the threat to SOC 2 CC6.1 (Logical Access Controls) and CC6.2 (User Authentication) – verify that mobile device policies enforce MFA, app vetting, and least‑privilege.
- Collect evidence of security‑awareness training that covers malicious app identification and safe mobile practices; retain attendance logs and quiz results as audit artifacts.
- Deploy mobile threat detection tools and continuously monitor for known RAT signatures on corporate devices.
Source: The Hacker News
Technical Notes
- Attack vector: malicious Android application delivered via a fake “Public Security” service app; the RAT can capture payment passwords, SMS, contacts, and device location.
- No public CVE; the threat leverages a custom framework whose source code is now openly shared.
- Indicators of compromise (IOCs) include the TLS certificate fingerprint observed on the 170 C2 servers and the control‑panel URL patterns disclosed by Hunt.io.