Loading story…
A targeted Android spyware implant dubbed ResidentBat has been linked to Belarusian state surveillance operations, with reporting tying it to the Belarusian KGB and victimology focused on journalists and civil society. The implant is assessed to have been under development since at least 2021 and was publicly exposed in December 2025 via a joint investigation by Reporters Without Borders (RSF) and RESIDENT.NGO. Unlike mass-distributed mobile malware, ResidentBat is deployed through hands-on access: operators use Android Debug Bridge (ADB) to sideload an APK, manually grant permissions, and disable Google Play Protect, trading scale for high-confidence, deliberate targeting.
Post-compromise, ResidentBat supports broad device surveillance and data theft, including access to SMS and call logs, microphone audio recording, screenshots, and local files, and it is reported to be able to intercept traffic from encrypted messaging apps. Infrastructure analysis attributed to Censys described a consistent C2 fingerprint, including self-signed TLS certificates with the common name CN=server and control traffic over a narrow port range 7000–7257; observed hosting was concentrated in Europe and Russia (including the Netherlands, Germany, Switzerland, and Russia). The C2 is described as supporting data collection, operator tasking, and configuration updates to maintain persistent control over infected devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On February 26, 2026, reporting summarized ResidentBat's functionality, including collection of SMS and call logs, microphone recording, screenshots, file access, encrypted messaging traffic interception, and remote device wiping. The same reporting described its hands-on deployment via ADB sideloading, manual permission grants, and disabling of Google Play Protect.
By February 2026, analysts reported active ResidentBat command-and-control infrastructure across ten hosts concentrated in the Netherlands, Germany, Switzerland, and Russia. Researchers also characterized technical traits including self-signed TLS certificates, a narrow port range, and anti-forensics behavior on the servers.
In December 2025, Reporters Without Borders and RESIDENT.NGO first publicly disclosed the ResidentBat Android spyware operation. Their investigation linked the spyware to highly targeted device compromise requiring physical access for installation.
Code history for the ResidentBat Android spyware indicates the operation's development dates back to 2021. The malware was later assessed as part of a Belarusian KGB-linked espionage effort targeting journalists and civil society members.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belarusian authorities have been found to deploy a previously unknown spyware, dubbed **ResidentBat**, on the smartphones of local journalists during police interrogations. The spyware was discovered after a journalist, interrogated by the Belarusian KGB, received malware alerts on their device. Investigations by Reporters Without Borders (RSF) and RESIDENT.NGO revealed that the spyware can access call logs, SMS and encrypted app messages, record audio, capture screens, and exfiltrate local files. The infection process reportedly involved authorities observing the journalist unlock their phone, then installing the spyware while the device was out of the journalist's possession. ResidentBat's server infrastructure has been active since at least March 2021, coinciding with anti-government protests in Belarus. The use of ResidentBat highlights a broader trend of authoritarian regimes leveraging spyware to target journalists and suppress independent reporting. Similar tactics have been observed in countries such as Serbia and Kenya, where authorities install surveillance tools on detainees' devices during questioning. The discovery of ResidentBat underscores the ongoing risks faced by journalists in Belarus, where state surveillance is used as a tool of repression. Google has been notified and is expected to alert other users potentially affected by this spyware.
Jun 29, 2026
Google and Mandiant disclosed **PROMPTSPY**, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples. The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected **PRC-nexus** actor to the use of tools including `Hexstrike`, `Graphiti`, `Strix`, `subfinder`, and `httpx` while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia **Operation Overload** campaign.
Jun 29, 2026
Researchers reported two **Telegram-marketed malware-as-a-service (MaaS)** offerings focused on mobile device compromise and surveillance. *ZeroDayRAT* is advertised as a subscription spyware platform claiming full monitoring of **Android and iOS** devices, with infections driven by **smishing** and other social-engineering lures that push victims to malicious links disguised as legitimate apps/updates; delivery chains reportedly use multi-stage redirects, URL shorteners, and in some cases trusted hosting such as *GitHub Pages* to evade reputation-based filtering. Once installed, the operator-facing web panel is advertised to provide extensive monitoring, including device profiling, app-usage timelines, GPS tracking, and remote activation of camera/microphone, plus screen recording and keystroke logging—capabilities consistent with credential theft and broad user surveillance. Separately, Cyble detailed ongoing development of *SURXRAT* (marketed as **SURXRAT V5**) as an Android RAT sold through a structured reseller/partner licensing model that enables affiliates to generate customized builds while the operator retains centralized control. The malware is described as a full-featured surveillance and device-control toolkit that abuses **Android Accessibility** permissions for persistent control and uses **Firebase-backed C2**; code similarities indicate lineage from **ArsinkRAT**. Recent samples were observed conditionally downloading a **large LLM module from Hugging Face**, which researchers assess as experimentation that could enable AI-assisted functionality, deliberate device performance impact, or new monetization approaches alongside established behaviors such as data exfiltration, remote command execution, and ransomware-style device locking.
Jun 29, 2026