ResidentBat Android Malware Provides Belarusian KGB with Persistent Access to Mobile Devices

ResidentBat is a targeted Android spyware campaign attributed to the Belarusian KGB that uses hands-on ADB sideloading to install an APK with extensive espionage capabilities (SMS/calls, microphone, screenshots, file access, interception of encrypted messaging) and remote wipe functionality; its C2 infrastructure is hardened and uses self-signed TLS certs (CN=server) on ports 7000–7257 with anti-forensics behaviors (catch-all 200 OK, static Date) and client-certificate allowlisting to evade detection.