KGB Used Spyware for Years to Monitor Journalists

The Digital Security Lab (DSL) of Reporters Without Borders (RSF), in collaboration with the Eastern European NGO RESIDENT.NGO, has uncovered a previously unknown spyware program. Reporters Without Borders believes it is being used by the State Security Committee of Belarus. The program has been named ResidentBat and is designed for Android-based devices.

ResidentBat allows access to sensitive data, such as call lists, audio recordings from the microphone, SMS messages, encrypted messenger correspondence, and local files.

Unlike well-known spyware tools like Pegasus, this software does not exploit remote system vulnerabilities; it is installed only after physical access to the device. This indicates the deliberate and targeted use of surveillance technologies.

The program was discovered on the phone of a journalist who had previously been interrogated at the KGB building in Belarus. Before the interrogation, the journalist was asked to leave their phone in a locker, and during the interrogation, to unlock the device and show part of its content in the presence of a KGB officer. Afterwards, the mobile phone was placed back in the locker.

As the journalist himself believes, and "Reporters Without Borders" confirms, KGB officers could have glimpsed the unlock code and installed the spyware while the interrogation was ongoing.

A few days later, the antivirus on the device reported suspicious software, after which the phone owner contacted RESIDENT.NGO.

Analysis conducted jointly with DSL and Reporters Without Borders revealed the existence of several versions of ResidentBat, likely used by the same entity. The oldest version discovered dates back to 2021, suggesting this software has been in use for at least four years.

"By implementing surveillance technologies like ResidentBat, the Belarusian authorities are pursuing a deliberate policy of repression against independent journalism. Such tools have nothing to do with protecting national security, contrary to what the enemy of free speech Alexander Lukashenka claims, but rather have much to do with threatening journalists and attempting to silence them.

Systematic intrusion into journalists' private lives and work is a direct attack on press freedom and fundamental rights. To effectively combat such crimes against journalists, an international ban on such intrusive surveillance technologies has long been necessary," emphasized Antoine Bernard, Director of Advocacy and Assistance at RSF.

RSF has shared the investigation's findings with Google, which plans to send "government-backed attack" warnings to users identified as targets of this spyware campaign. The identity of ResidentBat's developer remains unknown for now.

Journalists who suspect they might be under surveillance using such technical means can contact the RSF Digital Security Lab.

• 0
• 0
• 0
• 0
• 0
• 0
• 0
• 0