UnknownPublished 17 Dec 2025

OSINT · ResidentBat: A new spyware family used by Belarusian KGB

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - ResidentBat: A new spyware family used by Belarusian KGB

Impact

For European organizations, ResidentBat poses a significant espionage risk, particularly to governmental, diplomatic, and civil society entities engaged with Belarus or Eastern European affairs. The spyware's ability to deliver payloads and maintain persistence can lead to unauthorized access to sensitive information, undermining confidentiality and potentially compromising strategic decision-making. The integrity of data may also be at risk if the spyware manipulates or exfiltrates information. Although availability impact appears limited, prolonged undetected presence could facilitate further attacks or data leakage. The medium severity suggests that while the threat is not currently widespread, targeted attacks could have substantial consequences. European organizations with Belarusian connections or those involved in intelligence sharing may face increased targeting. The geopolitical tensions involving Belarus and neighboring countries amplify the risk of cyber espionage campaigns leveraging ResidentBat. Additionally, the spyware could be used to monitor dissidents or activists within Europe, raising privacy and human rights concerns. Overall, the threat could erode trust in digital communications and complicate diplomatic relations if exploited successfully.

Defensive guidance

To mitigate the threat posed by ResidentBat, European organizations should implement enhanced network monitoring focused on detecting unusual payload delivery and artifact creation behaviors. Deploying advanced endpoint detection and response (EDR) solutions capable of identifying persistence mechanisms and suspicious network activity is critical. Organizations should conduct threat hunting exercises using indicators of compromise (IoCs) as they become available, and maintain up-to-date threat intelligence feeds related to Belarusian cyber activities. Network segmentation and strict access controls can limit lateral movement if an infection occurs. Employee awareness training about spear-phishing and social engineering tactics, which are common initial infection vectors for spyware, should be reinforced. Regular audits of system integrity and logs can help identify anomalies indicative of spyware presence. Collaboration with national cybersecurity centers and information sharing with European CERTs can enhance detection and response capabilities. Given the lack of patches, proactive defense and rapid incident response are essential. Finally, organizations should review and harden their supply chain and third-party relationships to reduce exposure to targeted espionage campaigns.

Indicators of compromise

Domains 8

188.120.230.46
45.155.7.166
79.132.136.191
79.132.136.191
mtcat.info
mtcat.info
mtcat.info
mtcat.info

URLs 6

https://188.120.230.46:7003
https://45.155.7.166:7035
https://79.132.136.191:7007
https://79.132.136.191:7017
https://mtcat.info:7007
https://mtcat.info:7017

IP addresses 36

C2 / Infrastructure

121.37.196.157
62.109.11.98
38.180.100.160
5.129.213.114
5.253.63.176
5.253.61.156
62.109.26.144
47.106.191.231
91.240.87.211
83.220.169.120

Hashes 32

02dc81ea172e45f0a6fd7241fffd1042f6925c52d2f91dee36085634207be4f1APK Hashes
07d39205f9ba159236477a02cdb3350fac4f158e0dbf26576bb50604339b1f42APK Hashes
0ed73428c7729806be57989f340a09a323af914f197cc0cbb5509316ca5baf7bAPK Hashes
48e87bfcaa665bfbfcb027227384905878f090bbc19d02f74c41ade3cafb0950APK Hashes
77126e749a9c1144ae3cebb8deb0b72fc90d4eb73d1072a69a1248b4f518bb47APK Hashes
820c394b22b950335eb5cf21bc7df5c7a33081169f41440c74d67e7a8f196960APK Hashes
c3b92d05b105465881c0f68f5cf6c3edb24d2e5317ffd1256cb68c7921fe0721APK Hashes
fe05ba40f2d4b15db83524c169d030d097abc6713139ce6068969d97a24aa195APK Hashes
0ee925c49c085189c01ce9c6b56f0252
54094c857769a1d5270edff809ce4a143d230c6e

X509 fingerprint sha256 8

APK Certificate Hashes

18afc5c6bfaee504a26291f6bf3e6f823dbedd54bba0c4acac2e7c2414b3e24d
c1884e617348ebbdfe7cfe5fc99945b37296d6ebc6059bb74fbaeea277d32941
e5016f3cfb937d502dabedc32ca3bdef3bbcce032fb3b1bff3b9c6482895f4fd
d12616542268d32329f1c4357b5d5a57e954e13d2338d27bb8439794291b8c6d
3e9f1192e33cb851b48479629c93d29770a4f76af00f1e42a3c6e7f97db62c79
6782039a81a85264acdc6af0973b225ada6009f76faae7f948a1de040bb32f0c
a6a067b0d899fb514b7b4597d4fe16fcd4d7e5c361f6c84b3d45ed7e394036c7
6d6278ffc80ad9dd1b1c6b445847ce108f3ea5ce349f232689e9b8c1fd10801e

Port 6

7003
7035
7007
7017
7007
7017

Text 15

info
mtcat
info
mtcat
com.google.android.service
com.google.bat
com.huaweisettingsapp.mkz
com.linkedln.service
com.oneplussync.bat
com.android.framework.safety

Tlsh 8

t12aa42356c2018c07d9f4237e949ea50962fc090badc0fb4da74a532d2f2eb9151ddfae
t1cce42387af0fb0a2c6f38833179312529a570ca51973d0d3de8a56695d9afc0cf1bad4
t11bb4235642006c07e8f9273ed4ae955992e4090b6dc5ff0e6b1e532c2d2efa290dcf9d
t177741243ab10eecdcdb72335c2722094c2719d79599beee3891d90fa25b23e5d7809e0
t111b42243eb9ba9d0e9a379768bab4041913347553b63c69b2f41f4b80a73fc4c71a9c4
t117d42387ef0be061c6f7893353d35262809708995c72e0f3dd8796652daeb90db07e94
t119a423ae3f29a729d55d99fedafd623140b21e461b44721d4c0c31d8796e3ba27c0de0
t11fe423833663d680dafbd473ab6223b1607759b654f3c4e79681b078b5a66a0df03dc0

Vhash 8

209777f95128ad4f4da510c963776ebe
5e5e1c95ecff402cc4c8945a83401732
209777f95128ad4f4da510c963776ebe
f87cc874e24829eef63b376bc9d3a735
8d7c8e4216e592fc80240476f4cece81
5e5e1c95ecff402cc4c8945a83401732
209777f95128ad4f4da510c963776ebe
5e5e1c95ecff402cc4c8945a83401732

Ssdeep 8

12288:JsUmbr9ixH+XbQyEXQaaSwbl57OXk7FRbyIgrjEjdU6:Jki0X0yEXQP3b71CEjL
12288:bbK+Qe2LHgcQ0pnSrFn0guEdd3iNWxdkdzpoa7vAzM7qmCIXf3hJ456o8WTdjEjP:bge27BJcKgVdxGzua74zD9of3hJ4wWTC
12288:F2nsUmbr9ixH+XbQyEXQaaSwbl57OXk7FRbyjZk8vjEjdUK:Di0X0yEXQP3b7oZkmEjT
6144:cG7ae85i04BA7Qv0uPZH9QyWT+z1gu3g3/J++7C1EGdyKFgjEjd1pIk:f7PGR3W0ul9HWT+hN3g0vdMKyjEjdUk
12288:FOwH5tnx79C+XU2uCp2sEXtu7Y0+cmu4uuNuM4FLSbO71HPQpgajEjdUH:FOwHfxZT3p2sEs+3Zv48i7BPQpgIEjU
12288:cQHK+Qe2LHgcQ0pnSrFn0guEdd3iNWxdkdzpoj7vAzM7qmCIXf3hJ456oOVjEjdd:cXe27BJcKgVdxGzuj74zD9of3hJ4CRE7
12288:mI+lcyeXAl4W5CF8XqxgLrIFhhBSvnCyGX2JhdH8cRm2ZOjEjdU1:9ScivFaxgCgvnCyGX2Jhdfd6Ejk
12288:XeRkaATjRiM8mYgXgxH9pcDr4Mht7vAzM7qmCIXf3hJ456oYSXjjEjdU7:bv/N8hgwVLcDr4e74zD9of3hJ48SX3Ew

Link 2

https://www.virustotal.com/gui/file/07d39205f9ba159236477a02cdb3350fac4f158e0dbf26576bb50604339b1f42
https://rsf.org/sites/default/files/medias/file/2025/12/report_0.pdf

File 1

report_0.pdf

Community reviews

Loading reviews…