ResidentBat Android Malware Grants Belarusian KGB Ongoing Mobile Access

ResidentBat is a custom Android spyware implant attributed to the Belarusian KGB that is sideloaded via ADB during hands‑on device seizures to convert phones into persistent surveillance platforms; it collects SMS, call logs, microphone audio, screen captures, messenger content, local files, and supports remote factory wipes. The report documents deployment flow, C2 fingerprints (self‑signed TLS CN=server, ports 7000–7257 and 4022, stable banner hash), known infrastructure and geolocation, published APK hashes, and recommended mitigations (disable USB debugging/sideloading, monitor ADB usage, enable Play Protect/Advanced Protection).