Loading story…
Belarusian authorities have been found to deploy a previously unknown spyware, dubbed ResidentBat, on the smartphones of local journalists during police interrogations. The spyware was discovered after a journalist, interrogated by the Belarusian KGB, received malware alerts on their device. Investigations by Reporters Without Borders (RSF) and RESIDENT.NGO revealed that the spyware can access call logs, SMS and encrypted app messages, record audio, capture screens, and exfiltrate local files. The infection process reportedly involved authorities observing the journalist unlock their phone, then installing the spyware while the device was out of the journalist's possession. ResidentBat's server infrastructure has been active since at least March 2021, coinciding with anti-government protests in Belarus.
The use of ResidentBat highlights a broader trend of authoritarian regimes leveraging spyware to target journalists and suppress independent reporting. Similar tactics have been observed in countries such as Serbia and Kenya, where authorities install surveillance tools on detainees' devices during questioning. The discovery of ResidentBat underscores the ongoing risks faced by journalists in Belarus, where state surveillance is used as a tool of repression. Google has been notified and is expected to alert other users potentially affected by this spyware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After confirming the spyware, RSF notified Google about the ResidentBat case. Google said it planned to alert affected users about the compromise.
The infection was discovered after antivirus software flagged suspicious components on the journalist's phone, prompting forensic analysis by Reporters Without Borders and RESIDENT.NGO. Their investigation identified the malware as a previously unknown spyware family dubbed ResidentBat and documented its surveillance capabilities.
A Belarusian journalist's Android phone was infected with ResidentBat after the journalist was detained and interrogated by the Belarusian KGB. The case fit a broader pattern in which authorities allegedly install spyware on journalists' devices while they are in custody.
Forensic analysis by Reporters Without Borders indicated the previously unknown Android spyware later named ResidentBat had been in use since at least 2021. The malware was designed to extract call logs, SMS, encrypted app messages, files, microphone recordings, and screen captures from compromised devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcenews.risky.biz
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A targeted Android spyware implant dubbed **ResidentBat** has been linked to Belarusian state surveillance operations, with reporting tying it to the **Belarusian KGB** and victimology focused on journalists and civil society. The implant is assessed to have been under development since at least **2021** and was publicly exposed in **December 2025** via a joint investigation by Reporters Without Borders (RSF) and RESIDENT.NGO. Unlike mass-distributed mobile malware, ResidentBat is deployed through **hands-on access**: operators use **Android Debug Bridge (ADB)** to sideload an APK, manually grant permissions, and disable *Google Play Protect*, trading scale for high-confidence, deliberate targeting. Post-compromise, ResidentBat supports broad device surveillance and data theft, including access to **SMS and call logs**, **microphone audio recording**, **screenshots**, and **local files**, and it is reported to be able to **intercept traffic from encrypted messaging apps**. Infrastructure analysis attributed to **Censys** described a consistent C2 fingerprint, including **self-signed TLS certificates** with the common name `CN=server` and control traffic over a narrow port range **7000–7257**; observed hosting was concentrated in **Europe and Russia** (including the Netherlands, Germany, Switzerland, and Russia). The C2 is described as supporting data collection, operator tasking, and configuration updates to maintain persistent control over infected devices.
Jun 29, 2026
Citizen Lab and The First Department reported that Russian programmer Kirill Parubets received his Android phone back from authorities with spyware covertly installed after his detention in 2024. The malicious app was disguised as a trojanized version of **Cube Call Recorder** and, according to investigators, enabled extensive surveillance including location tracking, call recording, keylogging, screen capture, file theft, password extraction, access to messages in other apps, JavaScript injection, shell command execution, and recovery of the device unlock password. Researchers said the malware is closely related to the **Monokle** Android spyware family previously documented by Lookout and linked to **Special Technology Center, Ltd.**, a Russian government contractor, though the sample also showed differences that may indicate an updated variant or a new strain reusing Monokle code. The report also said Parubets was beaten, pressured to disclose his device password, and threatened by the FSB with severe punishment to coerce him into becoming an informant, underscoring the risk of using devices after they have been seized and returned by hostile state authorities.
Aug 14, 2026
Russia's Federal Security Service (**FSB**) said it uncovered a large-scale espionage operation in which malware was implanted on the smartphones of senior Russian government officials. According to the agency, the spyware enabled theft of correspondence, call data, geolocation, contact lists, and other stored information, while also allowing interception of conversations and covert activation of device microphones and cameras for audio and video collection. Russian authorities said they opened a criminal investigation into illegal access to computer information and malware distribution and are conducting forensic analysis to identify the perpetrators, map the supporting infrastructure, and determine the scope of the compromise. The FSB did not publish technical evidence, name the malware, disclose victim counts, or specify the infection vector, though reporting said infrastructure linked to **Cloudflare** and **Fastly** appeared in footage released by the agency without accusing either company of direct involvement; the allegations also echo Russia's earlier claims around the **Operation Triangulation** iPhone spyware campaign.
Jun 29, 2026