🦇 ResidentBat: Operational Report & Advisory on KGB spyware in Belarus in 2025

RESIDENT.NGO has helped uncover a #malware attack targeted at a Belarus-based #journalist by the Belarusian secret service (KGB). This document serves as a short synopsis of the case, offering #safetyrecommendations and indicators of compromise (IoCs).

🌍 https://resident.ngo/lab/writeups/residentbat-android-kgb-spyware-in-belarus-2025/

📄 Full Technical Report RSF: https://rsf.org/sites/default/files/medias/file/2025/12/report1.pdf

#residentbat #spyware #residentngo #ReportersWithoutBorders #digitalsecurity #malware

ResidentBat: Operational Report & Advisory on KGB spyware in Belarus in 2025
#BelarusianKGB #ResidentBat
https://resident.ngo/lab/writeups/residentbat-android-kgb-spyware-in-belarus-2025/

Spionagesoftware enttarnt: Wie #Belarus 🇧🇾 Journalisten mit "#ResidentBat" überwacht | Security https://www.heise.de/news/Spionagesoftware-enttarnt-Wie-Belarus-Journalisten-mit-ResidentBat-ueberwacht-11118846.html #Android :android: #Google :google: #Spyware #Malware #KGB #Weissrussland 🇧🇾

Reporters Without Borders:
Belarus 🇧🇾
The #spyware, initially labelled “ResidentBat” when identified, targets Android smartphones and enables access to highly sensitive data

Unlike well-known spyware products used against journalists such as Pegasus, #ResidentBat does not exploit digital vulnerabilities

.. is installed after security forces gain physical access to a device
https://rsf.org/en/exclusive-rsf-uncovers-new-spyware-belarus

#Bélarus : RSF révèle l'existence d'un logiciel espion inconnu, utilisé depuis 2021 par le KGB contre des journalistes. Installé après confiscation physique des téléphones, #ResidentBat viole gravement la liberté de la presse. RSF demande l’interdiction de ces technologies de surveillance.
https://rsf.org/fr/exclusif-rsf-met-au-jour-un-nouveau-logiciel-espion-utilis%C3%A9-par-le-kgb-bi%C3%A9lorusse

#ResidentBat: This document serves as a short synopsis of the case, offering safety recommendations and indicators of compromise (IoCs).
🔗 https://resident.ngo/lab/writeups/residentbat-android-kgb-spyware-in-belarus-2025/
2/2

Reporters Without Borders (RSF)’s Digital Security Lab (DSL), working with the Eastern European organisation RESIDENT.NGO, has uncovered a previously unknown #spyware tool used by the State Security Committee (KGB) of #Belarus to target, among others, journalists and media workers. RSF assesses that this exposure is a serious setback for the KGB’s operations, not least because the software appears to have been in use for several years. #ResidentBat

https://rsf.org/en/exclusive-rsf-uncovers-new-spyware-belarus