Flying Eagle Android RAT: TLS Certificate Pivots, Panel Fingerprints, and 170 Servers Across Hong Kong ASNs
MALWsource · RDT
<!-- SC_OFF --><div class="md"><p>Joint investigation with NetAskari. Starting from two IPs named in a June 2026 Chinese state media notice, we pivoted on Let's Encrypt certificate subjects and an AdminPro panel fingerprint (302 to HTTPS, Strict-Transport-Security: max-age=31536000, /login?redirect=list/basic-list route) to identify 170 active servers, concentrated across Antbox Networks Limited, Cognetcloud, CTG Server Limited, and Zillion Network Inc. in Hong Kong. …
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected