"By deploying surveillance technologies such as ResidentBat, the Belarusian state is pursuing a deliberate strategy of repression against independent journalism" - RSF
This statement was originally published on rsf.org on 17 December 2025.
Reporters Without Borders (RSF)’s Digital Security Lab (DSL), working with the Eastern European organisation RESIDENT.NGO, has uncovered a previously unknown spyware tool used by the State Security Committee (KGB) of Belarus to target, among others, journalists and media workers. RSF assesses that this exposure is a serious setback for the KGB’s operations, not least because the software appears to have been in use for several years.
The spyware, initially labelled “ResidentBat” when identified, targets Android smartphones and enables access to highly sensitive data. Unlike well-known spyware products used against journalists such as Pegasus, ResidentBat does not exploit digital vulnerabilities. Instead, it is installed after security forces gain physical access to a device. Once installed, ResidentBat enables access to call logs, microphone recordings, screen captures, SMS messages, messages from encrypted messaging apps, and locally stored files.
“By deploying surveillance technologies such as ResidentBat, the Belarusian state is pursuing a deliberate strategy of repression against independent journalism. These tools have nothing to do with national security as alleged by press freedom predator Loukachenko, instead they have everything to do with intimidation and silencing of journalists. The systematic invasion of their private and professional lives amounts to a direct and unlawful assault on press freedom and fundamental rights. An international ban on such invasive and perverse technologies has been long overdue, as effective prosecution of such crimes against journalists.”
Antoine Bernard, Director, Advocacy & Assistance
Spyware masquerading as a regular app
ResidentBat was detected on the smartphone of a journalist who had been questioned by the KGB. RSF has verified the person’s identity but is not publishing it for security reasons.
Before the interrogation at KGB premises, the individual was asked to place the smartphone in a locker. During questioning, the journalist was required to show content on the device and unlocked the phone in an officer’s presence. Afterwards, the device was placed in the locker again. The individual and RSF believe that the security forces observed the PIN entry, retrieved the phone during the interrogation and installed the spyware.
A few days later, antivirus software flagged suspicious components on the device. The individual contacted RESIDENT.NGO, which carried out a forensic analysis together with RSF’s DSL.
In use for years
By comparing samples on an antivirus platform, RSF’s DSL identified additional ResidentBat variants likely used by the same actor. One analysed version dates back to 2021. RSF therefore believes that the KGB has been using the spyware for at least four years. RSF has shared the result of its research with Google. In order to further protect targeted individuals, the tech giant will send a “government-backed attack” threat notification to all Google users who were identified by Google as targets of this spyware campaign.
It is not yet clear who developed ResidentBat. Parts of the code contain English-language strings, suggesting it may be a product not designed exclusively for use in Belarus, or developed by a third party.
Press freedom in Belarus
Independent journalism is heavily suppressed in Belarus. Journalists face censorship, intimidation, violence and arbitrary detention. At present, 32 journalists are imprisoned, and reports of torture are increasing. Many have fled the country since 2020 and work from exile. Those who continue to report from within Belarus often do so anonymously and at considerable personal risk. The use of spyware is part of this systematic repression. Belarus currently ranks 166th out of 180 countries and territories in the 2025 RSF World Press Freedom Index.
More information
The full technical report is available here.
Journalists who suspect they may have been subject to similar surveillance can contact RSF’s Digital Security Lab. You can also find the report on the Resident.ngo website.
