Belarusian spyware co-founder linked to apps sending user data to Belarus and Russia
A Belarusian businessman with a background in spyware has launched a dozen mobile apps that are purportedly based in Lithuania. But technical analysis indicates that the apps send data to companies in Belarus and Russia, raising the risk that they could be used to surveil political exiles.
Over 50 million people downloaded Nicegram, which allows users to access channels on the messaging service Telegram that have been blocked. More than one million people have downloaded eSIM Plus, which provides users with mobile data and virtual phone numbers.
The listed developer for both those apps is Appvillis, a Lithuanian company. But OCCRP’s Belarusian member center Buro found evidence that raises questions over where Appvillis products are actually developed.
Analysis of the apps’ code and digital identifiers indicate they may in fact be developed by a Belarusian company called Mobyrix. The company also appears to take care of technical support for the apps, which indicates that data is being sent to Belarus, as well as in some cases to Russia.
Belarus has been ruled since 1994 by Aleksandr Lukashenko, and his regime is notorious for human rights abuses and targeting political opponents.
Appvillis and Mobyrix are both owned by Belarusian businessman Andrei Shimanovich, a cofounder of the surveillance app mSpy. The app was the source of major data leaks including a 2024 hack that reportedly exposed millions of email addresses, phone numbers and other information.
Shimanovich did not respond to calls or written requests for comment.
Alina Viarbouskaya, a Belarusian journalist living in exile, said Buro’s findings are “alarming” because she uses eSIM Plus — which is listed on Mobyrix’s website — when travelling outside Europe.
“I usually just check the ratings in the App Store and, frankly, don’t really understand who’s behind the service,” she told Buro. “I now understand that this may not be safe.”
Vytis Jurkonis, a Belarus expert at Vilnius University’s Institute of International Relations and Political Science, highlighted Shimanovich’s business in Belarus as well as his marriage to the daughter of Viktor Sheiman, one of Lukashenko’s closest associates.
Sheiman has been sanctioned by U.S. and European authorities for his alleged role in the disappearances of regime critics, and for his support of Lukashenko. Sheiman did not respond to phone calls for comment.
Shimanovich’s “connection to Lukashenko’s regime is obvious,” said Jurkonis, who also heads the Lithuanian office of Freedom House, a U.S.-based pro-democracy non-profit.
“First, this is indicated by a long-standing closeness to someone like Viktor Sheiman. He is a politically exposed person, and he is also under sanctions. Second, any business in Belarus must undergo additional security screening, as the risk of a red flag is high,” he said.
Buro’s analysis found that at least some of Nicegram’s code belongs to Mobyrix, Shimanovich’s company that was founded in Belarus one month after Appvillis.
Appvillis and Mobyrix have almost identical websites, logos, and portfolios. The only official employee of Appvillis is Shimanovich, and the company sends users to the Belarusian company Mobyrix for technical support.
Appvillis and Mobyrix did not respond to requests for comment.
When installing Nicegram — the app that allows users to access Telegram channels that have been blocked for reasons such as promoting pornography or violence — users share their name, email address, and phone number. In order to fully utilize the app they must also agree to give access to location, microphone, camera, photos, videos, and audio. If they sync contacts, the app can access names and phone numbers from their address book.
Meanwhile, the privacy policy for eSIM Plus says it automatically collects IP addresses and location data. It also directly uses contacts, and may collect device technical data and request access to the camera and other phone functions.
Cybersecurity experts from Human Constanta, a Belarusian human rights organization based in Lithuania, tested eSIM Plus and found that the app sends technical data to Yandex AppMetrica, a Russian service. The app also uses the Russian company Voximplant to route calls.
The user policy for eSIM Plus states that it may disclose information “in order to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.”
Head of Investigations
Read more similar news:
Comments:
comments powered by Disqus
