Is the Belarusian government behind the surveillance Android app banned by Google?

Google has removed an app from the Play Store that was used by the Belarusian government to spy on anti-government protesters.

Google has removed the app NEXTA LIVE (com.moonfair.wlkm) from the official Play Store because it was used by the Belarusian government to spy on anti-government protesters. The malicious app remained in the store for almost three weeks and was downloaded thousands of times and received hundreds of reviews.

App mimicked a popular anti-government news site and collected location and device owner details.

Google has removed this week an Android app from the Play Store that was used to collect personal information from Belarusians attending anti-government protests.

The NEXT LIVE app claimed to be the official Android app for the independent Belarusian news agency Nexta which was very popular among anti-Lukashenko protesters due to its reports on the abuses of the local authorities.

Last week the Nexta agency published a statement on its Telegram channel to warn its audience about the risk associated with the malicious app that was designed to unmask protesters.

“Do not install under any circumstances. Warn your friends, maximum repost!,” reads the message published by Nexta on Telegram.

According to an anonymous Belarusian security researcher the app was designed for surveillance purposes, it collects info on the device owner and geolocation data, then periodically sends the data back to a remote server.

“Android malware researcher Gabriel Cîrlig, who ZDNet asked earlier today to also look at NEXTA LIVE, said the app appears to communicate with a domain hosted on a Russian IP address, at arcpi.nextialive.roimaster[.]site (89.223.89[.]47).” read a post published by ZDNet.

Experts pointed out that the IP address previously hosted other suspicious-looking domains (i.e., hackappnewcrmuzbekistan.roimaster[.]site), a circumstance that suggest it may have been involved in other government-backed campaigns.

At the time, there is evidence that could allow experts to attribute the app to the Belarusian government.

Pierluigi Paganini

(SecurityAffairs – hacking, Belarusian government)