Ah interesting: there is indeed at least one C2 server still up in CH for the Belarusian ResidentBat spyware.

[decio@infosec.exchange]

Ah interesting: there is indeed at least one C2 server still up in CH for the Belarusian ResidentBat spyware. (https://censys.com/blog/residentbat-belarusian-kgb-android-spyware/)

( Query used:

app.http.headermd5:"78bee3c04822d03e0f8f606120771d83" issuer.commonname:"server" )

A strange coincidence, ...or not a coincidence at all, this IP was previously linked in 2022 to a Russian group/website opposing the war in Ukraine...