Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands

The report

Over the past month we collected and analysed 64 Android samples (first seen 2026-09-15 to 2026-10-16) that are all the same thing: a thin dropper that installs a packed second-stage WebSocket RAT. The operators run a web control panel that brands itself with a hawk logo and one of two Chinese names, 黑鹰安卓远控 (“Black Hawk Android Remote Control”) and 雄鹰安卓远程 (“Eagle Android Remote”), over an identical login page and tagline (安全、高效的设备管理控制平台).

Read the full analysis: Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands (STAR Labs).

Indicators

The report is tracked for context; no indicator from it met the bar for blocking (for example, it only names shared hosting).

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#22). This page is generated from that record and the report’s own title and summary; nothing is rewritten.