Belarus’ KGB using ResidentBat spyware to target journalists
December 17, Pozirk. Belarus’ Committee for State Security (KGB) has been using the ResidentBat spyware since 2021 to target, among others, journalists, found Reporters Without Borders (RSF)’s Digital Security Lab (DSL), working with the Eastern European organization RESIDENT.NGO.
ResidentBat was detected on the smartphone of a journalist who had been questioned by the KGB. RSF has verified the person’s identity but is not publishing it for security reasons.
Before the interrogation at KGB premises, the individual was asked to place the smartphone in a locker. During questioning, the journalist was required to show content on the device and unlocked the phone in an officer’s presence. Afterwards, the device was placed in the locker again. The individual and RSF believe that the security forces observed the PIN entry, retrieved the phone during the interrogation and installed the spyware.
A few days later, antivirus software flagged suspicious components on the device. The individual contacted RESIDENT.NGO, which carried out a forensic analysis together with RSF’s DSL.
The spyware targets Android smartphones and enables access to highly sensitive data. Unlike well-known spyware products used against journalists such as Pegasus, ResidentBat does not exploit digital vulnerabilities. Instead, it is installed after security forces gain physical access to a device. Once installed, ResidentBat enables access to call logs, microphone recordings, screen captures, SMS messages, messages from encrypted messaging apps, and locally stored files.
It is not yet clear who developed ResidentBat. Parts of the code contain English-language strings, suggesting it may be a product not designed exclusively for use in Belarus, or developed by a third party.
“By deploying surveillance technologies such as ResidentBat, the Belarusian state is pursuing a deliberate strategy of repression against independent journalism,” said Antoine Bernard of RSF.
At present, 32 journalists are imprisoned, and reports of torture are increasing. Many have fled the country since 2020 and work from exile. Those who continue to report from within Belarus often do so anonymously and at considerable personal risk.
