ResidentBat: A new spyware family used by Belarusian KGB

ResidentBat — an Android spyware family attributed to the Belarusian KGB — is installed via physical access and uses device administration and an accessibility service to capture SMS, calls, files, microphone/camera, screenshots and app content. The report provides a technical analysis of capabilities, manifest permissions, configuration options, C2 infrastructure and timelines dating back to 2021, includes IoCs (IPs, package names, APK hashes and certificates), and offers detection and mitigation guidance for targeted users.