Loading story…
Lithuanian authorities have opened a national security review after reporting and technical analysis linked the Android apps Nicegram and eSIM Plus to Belarus rather than the Lithuanian branding used in app stores. Investigators said the apps were presented as products of Lithuanian company Appvillis, but code and signing artifacts tied them to Belarusian company Mobyrix and businessman Andrei Shimanovich. In the strongest finding, researchers said eSIM Plus was signed by "Mobyrix, Minsk" and included active integrations with Russian services including Yandex AppMetrica and Voximplant, with call routing through a .ru endpoint.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Andrei Shimanovich obtained a Lithuanian temporary residence permit as a startup founder. OCCRP reports he has held this legal status since 2023.
Lithuanian authorities said they are reassessing the national security implications of Andrei Shimanovich after the reporting on the apps. The Migration Department said it will ask the State Security Department to reevaluate his risk and will involve the National Cyber Security Center and Criminal Police Bureau to examine the linked applications for vulnerabilities and possible malicious behavior.
A Buro and OCCRP investigation reported that apps presented as Lithuanian products, including Nicegram and eSIM Plus, were actually developed and maintained in Belarus and were linked technically to Shimanovich’s Belarusian company Mobyrix. The reporting also said some of the apps transmitted user data to services in Belarus and Russia, raising privacy and security concerns.
An analysis of the Android apps eSIM Plus and Nicegram found they appear to share an Appvillis-linked codebase, supporting prior reporting that the apps were allegedly developed and controlled from Belarus. The strongest technical evidence cited was in eSIM Plus, including a package signed by "Mobyrix, Minsk" and integrations with Russian services such as Yandex AppMetrica and Voximplant.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers said China-aligned espionage group **GREF** distributed trojanized Android messaging apps, **Signal Plus Messenger** and **FlyGram**, through **Google Play**, the **Samsung Galaxy Store**, dedicated websites, and in FlyGram’s case a Uyghur-focused Telegram channel. The apps carried the **BadBazaar** spyware family and were tied to targeting patterns previously associated with **Uyghurs and other Turkic minorities**. Google removed the malicious apps after notification, but ESET reported they were still present in Samsung’s store at the time of publication. **Signal Plus Messenger** abused Signal’s legitimate linked-device feature in what researchers described as the first documented case of covert Signal account spying through secret device linking, allowing attackers to intercept messages without alerting victims. **FlyGram** impersonated Telegram and stole device and Telegram-related data, while a malicious **Cloud Sync** feature uploaded backups and metadata to attacker-controlled servers; ESET observed at least **13,953 accounts** enabling that feature. Researchers said the fake Signal app saw fewer than **500 downloads** on Google Play, suggesting a more targeted operation than broad consumer malware distribution.
Aug 15, 2026
A targeted Android spyware implant dubbed **ResidentBat** has been linked to Belarusian state surveillance operations, with reporting tying it to the **Belarusian KGB** and victimology focused on journalists and civil society. The implant is assessed to have been under development since at least **2021** and was publicly exposed in **December 2025** via a joint investigation by Reporters Without Borders (RSF) and RESIDENT.NGO. Unlike mass-distributed mobile malware, ResidentBat is deployed through **hands-on access**: operators use **Android Debug Bridge (ADB)** to sideload an APK, manually grant permissions, and disable *Google Play Protect*, trading scale for high-confidence, deliberate targeting. Post-compromise, ResidentBat supports broad device surveillance and data theft, including access to **SMS and call logs**, **microphone audio recording**, **screenshots**, and **local files**, and it is reported to be able to **intercept traffic from encrypted messaging apps**. Infrastructure analysis attributed to **Censys** described a consistent C2 fingerprint, including **self-signed TLS certificates** with the common name `CN=server` and control traffic over a narrow port range **7000–7257**; observed hosting was concentrated in **Europe and Russia** (including the Netherlands, Germany, Switzerland, and Russia). The C2 is described as supporting data collection, operator tasking, and configuration updates to maintain persistent control over infected devices.
Jun 29, 2026
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families **BadBazaar** and **Moonshine** in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, **`TibetOne`**, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities. Technical analysis from the Australian Cyber Security Centre said **Moonshine** was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while **BadBazaar** included Android and iOS variants such as **BadSolar** and **BadSignal**. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with **TA413**, **APT5**, **APT14**, and infrastructure linked to **UPSEC**.
Jun 29, 2026