Loading story…
Citizen Lab and The First Department reported that Russian programmer Kirill Parubets received his Android phone back from authorities with spyware covertly installed after his detention in 2024. The malicious app was disguised as a trojanized version of Cube Call Recorder and, according to investigators, enabled extensive surveillance including location tracking, call recording, keylogging, screen capture, file theft, password extraction, access to messages in other apps, JavaScript injection, shell command execution, and recovery of the device unlock password.
Researchers said the malware is closely related to the Monokle Android spyware family previously documented by Lookout and linked to Special Technology Center, Ltd., a Russian government contractor, though the sample also showed differences that may indicate an updated variant or a new strain reusing Monokle code. The report also said Parubets was beaten, pressured to disclose his device password, and threatened by the FSB with severe punishment to coerce him into becoming an informant, underscoring the risk of using devices after they have been seized and returned by hostile state authorities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In June 2024, Russian authorities detained Russian programmer Kirill Parubets for 15 days after accusing him of sending money to Ukraine. During a search of his apartment, authorities confiscated his Android phone, and Parubets said he was beaten and pressured to reveal its password while the FSB tried to recruit him as an informant.
In 2019, Lookout previously reported on the Monokle spyware family and linked it to Special Technology Center, Ltd., a Russian government contractor based in St. Petersburg. Citizen Lab later cited this prior reporting as the baseline for comparing the Parubets sample.
The First Department identified a likely malicious app on Parubets' phone, and Citizen Lab confirmed it was a trojanized version of Cube Call Recorder. The malware had extensive surveillance capabilities, and researchers assessed it was closely related to Monokle, either as an updated variant or new malware reusing much of the same code.
After his release, Parubets received his phone back at the FSB headquarters in Lubyanka and noticed unusual behavior, including a suspicious notification reading "Arm cortex vx3 synchronization." This prompted scrutiny of the device after it had been out of his control in Russian custody.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia's Federal Security Service (**FSB**) said it uncovered a large-scale espionage operation in which malware was implanted on the smartphones of senior Russian government officials. According to the agency, the spyware enabled theft of correspondence, call data, geolocation, contact lists, and other stored information, while also allowing interception of conversations and covert activation of device microphones and cameras for audio and video collection. Russian authorities said they opened a criminal investigation into illegal access to computer information and malware distribution and are conducting forensic analysis to identify the perpetrators, map the supporting infrastructure, and determine the scope of the compromise. The FSB did not publish technical evidence, name the malware, disclose victim counts, or specify the infection vector, though reporting said infrastructure linked to **Cloudflare** and **Fastly** appeared in footage released by the agency without accusing either company of direct involvement; the allegations also echo Russia's earlier claims around the **Operation Triangulation** iPhone spyware campaign.
Jun 29, 2026
A targeted Android spyware implant dubbed **ResidentBat** has been linked to Belarusian state surveillance operations, with reporting tying it to the **Belarusian KGB** and victimology focused on journalists and civil society. The implant is assessed to have been under development since at least **2021** and was publicly exposed in **December 2025** via a joint investigation by Reporters Without Borders (RSF) and RESIDENT.NGO. Unlike mass-distributed mobile malware, ResidentBat is deployed through **hands-on access**: operators use **Android Debug Bridge (ADB)** to sideload an APK, manually grant permissions, and disable *Google Play Protect*, trading scale for high-confidence, deliberate targeting. Post-compromise, ResidentBat supports broad device surveillance and data theft, including access to **SMS and call logs**, **microphone audio recording**, **screenshots**, and **local files**, and it is reported to be able to **intercept traffic from encrypted messaging apps**. Infrastructure analysis attributed to **Censys** described a consistent C2 fingerprint, including **self-signed TLS certificates** with the common name `CN=server` and control traffic over a narrow port range **7000–7257**; observed hosting was concentrated in **Europe and Russia** (including the Netherlands, Germany, Switzerland, and Russia). The C2 is described as supporting data collection, operator tasking, and configuration updates to maintain persistent control over infected devices.
Jun 29, 2026
Google's Threat Analysis Group said **Cytrox's Predator spyware** was deployed in three 2021 campaigns that chained **five zero-day vulnerabilities** across **Chrome** and **Android** to compromise fully updated Android devices, including Samsung phones. The attacks used one-time spear-phishing links sent by email, redirected victims through attacker-controlled domains, and then forwarded them to legitimate websites after exploitation. Google said the exploit chains included Chrome sandbox escapes, Android privilege-escalation flaws, and in some cases a Samsung browser pivot, allowing operators to install the **Alien** malware first and then load the **Predator** implant. Google assessed with high confidence that Cytrox, a North Macedonian spyware vendor, packaged the exploits and sold them to multiple government-backed customers linked to **Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia**. The campaigns were described as limited in scale, targeting only tens of users, but the spyware gave operators extensive surveillance access, including the ability to record audio, add CA certificates, and hide apps. Google's findings aligned with earlier **Citizen Lab** reporting that identified Predator on the phone of exiled Egyptian politician **Ayman Nour**, underscoring the growing commercial market for mercenary spyware and delayed patching risks such as **CVE-2021-1048**.
Aug 15, 2026