Exclusive: RSF uncovers new spyware from Belarus

The spyware, initially labelled "ResidentBat" when identified, targets Android smartphones and enables access to highly sensitive data. Unlike well-known spyware products used against journalists such as Pegasus, ResidentBat does not exploit digital vulnerabilities. Instead, it is installed after security forces gain physical access to a device. Once installed, ResidentBat enables access to call logs, microphone recordings, screen captures, SMS messages, messages from encrypted messaging apps, and locally stored files.

Spyware masquerading as a regular app

ResidentBat was detected on the smartphone of a journalist who had been questioned by the KGB. RSF has verified the person's identity but is not publishing it for security reasons.

Before the interrogation at KGB premises, the individual was asked to place the smartphone in a locker. During questioning, the journalist was required to show content on the device and unlocked the phone in an officer's presence. Afterwards, the device was placed in the locker again. The individual and RSF believe that the security forces observed the PIN entry, retrieved the phone during the interrogation and installed the spyware.

A few days later, antivirus software flagged suspicious components on the device. The individual contacted RESIDENT.NGO, which carried out a forensic analysis together with RSF's DSL.

In use for years

By comparing samples on an antivirus platform, RSF's DSL identified additional ResidentBat variants likely used by the same actor. One analysed version dates back to 2021. RSF therefore believes that the KGB has been using the spyware for at least four years. RSF has shared the result of its research with Google. In order to further protect targeted individuals, the tech giant will send a "government-backed attack" threat notification to all Google users who were identified by Google as targets of this spyware campaign.

It is not yet clear who developed ResidentBat. Parts of the code contain English-language strings, suggesting it may be a product not designed exclusively for use in Belarus, or developed by a third party.

Press freedom in Belarus

Independent journalism is heavily suppressed in Belarus. Journalists face censorship, intimidation, violence and arbitrary detention. At present, 32 journalists are imprisoned, and reports of torture are increasing. Many have fled the country since 2020 and work from exile. Those who continue to report from within Belarus often do so anonymously and at considerable personal risk. The use of spyware is part of this systematic repression. Belarus currently ranks 166th out of 180 countries and territories in the 2025 RSF World Press Freedom Index.

More information

The full technical report is available here.

Journalists who suspect they may have been subject to similar surveillance can contact RSF's Digital Security Lab. You can also find the report on Resident.ngo website.