Listen to this Post
Introduction, Why Trust in Mobile Apps Matters More Than Ever
Millions of people download apps every day without thinking twice about what happens behind the installation screen. App store descriptions, publisher names, and branding often create a sense of confidence that users rarely question. However, modern mobile applications are increasingly complex, relying on dozens of third-party services, cloud platforms, analytics frameworks, and communication systems that remain invisible to ordinary users.
A recent technical investigation by the Mysterium VPN Research Team demonstrates exactly why transparency matters. Their reverse engineering analysis of two widely downloaded applications, Nicegram and eSIM Plus, uncovered technical evidence that challenges the public image presented in European app stores. While both applications are marketed under Lithuanian branding, the internal code, digital certificates, and infrastructure reveal a far more complicated story involving Belarusian development and, in one case, active integrations with Russian services.
The findings do not simply raise geopolitical questions. They highlight a broader cybersecurity issue that affects every smartphone user, regardless of country: can consumers truly know who develops their applications and where their personal information travels after installation?
The Investigation That Looked Beyond the App Store
Instead of relying on public statements or marketing materials, researchers performed a static analysis of the Android application packages (APK files) themselves.
This forensic approach allowed investigators to inspect:
Digital signatures
Embedded SDKs
Network endpoints
Analytics frameworks
Application permissions
Backend infrastructure
Internal developer references
Their objective was to verify earlier reporting from the Organized Crime and Corruption Reporting Project (OCCRP), which alleged that both applications were actually developed and controlled from Belarus despite appearing to be Lithuanian products.
The technical evidence recovered from the binaries largely supports those claims.
eSIM Plus Reveals a Belarusian Digital Signature
Among all the evidence discovered, the
Every Android application is digitally signed before distribution. That signature identifies the entity responsible for producing the software.
Researchers found that eSIM Plus version 4.4.26 carries a certificate signed by:
Mobyrix, Minsk, Belarus
The certificate even includes the Minsk postal code 220020, providing direct technical evidence that the software originated from Belarus rather than Lithuania.
Unlike branding or company registrations, cryptographic signatures cannot simply be explained away as marketing choices. They form part of Android’s trust infrastructure and authenticate the software itself.
Russian Services Embedded Inside eSIM Plus
The researchers discovered that eSIM Plus integrates two significant Russian technology services directly into the application.
These include:
Yandex AppMetrica
Voximplant
Both integrations were found to be fully functional rather than dormant code.
The investigation reported thousands of references connected to these SDKs throughout the application.
Yandex AppMetrica Collects Extensive Analytics
One of the most significant discoveries was the integration of Yandex AppMetrica.
Researchers identified approximately 2,900 references to the analytics platform.
The SDK communicates with:
yandex.net
appmetrica.io
immediately after application startup.
According to the report, AppMetrica is designed to derive client IP addresses on the server side while supporting extensive event tracking.
Location tracking capabilities were also enabled within the application.
This indicates that user analytics are not limited to simple crash reports but may include detailed behavioral information.
Voice Calls Routed Through Russian Infrastructure
Perhaps the most surprising technical finding involved voice communication.
Researchers found approximately 1,700 code references connected to the Voximplant communication platform.
The application contains classes such as:
VoximplantCallManager
VoximplantIncomingCallService
The investigation determined that voice communications are routed through:
balancer.root.voximplant.ru
using the account:
appvillis.n8.voximplant.com
This means users making calls through eSIM Plus may unknowingly send communication traffic through Russian-hosted infrastructure.
According to the researchers, nothing in the
A Massive Collection of User Permissions
Modern mobile apps frequently request extensive permissions, but researchers described eSIM Plus as unusually broad.
The application requests approximately 35 Android permissions, including access to:
Fine location
Coarse location
Contacts
Camera
Microphone
Phone services
Telephony functions
Combined with multiple analytics frameworks, this creates a substantial data collection surface.
Numerous Analytics Platforms Working Together
Beyond Yandex AppMetrica, researchers identified several additional services embedded inside eSIM Plus.
These include:
Mixpanel
Segment
Customer.io
AppsFlyer
Facebook SDK
Firebase
Qonversion
Payment SDKs
Additional telephony services
Each framework performs different functions, ranging from user engagement to attribution, subscriptions, purchases, crash reporting, and customer analytics.
Individually these tools are common throughout the mobile ecosystem. Together, they create a highly detailed profile of user behavior.
Nicegram Shares Infrastructure but Shows Different Technical Characteristics
Nicegram, which has accumulated over 50 million downloads, shares portions of the same Appvillis infrastructure according to the researchers.
However, the specific build analyzed presented notable differences.
Researchers found no evidence of:
Yandex AppMetrica
Voximplant
Belarusian endpoints
Mobyrix strings
Instead, they identified only two Russian-hosted domains.
These were:
static-maps.yandex.ru
coub.com
According to the report, both are inherited upstream services rather than telemetry systems.
One provides optional map tiles.
The other supports embedded media.
Researchers described both as benign and activated only through specific user actions.
Nicegram Still Requests Extensive Access
Although the Russian SDKs were absent in this version, Nicegram still requests an extensive number of permissions.
The application declares approximately 73 Android permissions, including:
Background location
Camera
Phone identity
Storage access
Researchers also identified additional features including:
A non-custodial cryptocurrency wallet
Seed phrase management
A profiling component nicknamed God’s Eye
According to the report, this module analyzes Telegram activity patterns by sending channel and session information back to Nicegram servers.
Shared Development Claims Gain Technical Support
While Nicegram itself did not contain the Russian analytics frameworks identified in eSIM Plus, researchers argue that both applications still support the shared-developer hypothesis.
Their conclusion is based on similarities in:
Backend infrastructure
Shared codebase
Appvillis branding
Development architecture
The strongest technical evidence remains inside eSIM Plus through its signing certificate and Russian service integrations.
The Bigger Issue, Transparency Versus Reality
The investigation highlights a challenge extending far beyond these two applications.
Users generally trust information displayed on official app stores.
That trust assumes:
Accurate publisher information
Transparent ownership
Honest infrastructure disclosures
Yet software binaries can tell a different story.
The package itself may reveal developers, cloud services, analytics providers, and communication systems that remain completely invisible before installation.
For average consumers, conducting reverse engineering before downloading an application is unrealistic.
This creates an information gap where users must rely almost entirely on trust.
Why Mobile Supply Chains Deserve Greater Scrutiny
Modern applications rarely consist of software written by a single company.
Instead, they depend on numerous external services including:
Authentication providers
Analytics platforms
Cloud infrastructure
Advertising SDKs
Communication APIs
Payment gateways
Each additional integration expands the
Security professionals increasingly argue that application transparency should include not only the publisher’s name but also meaningful disclosure regarding backend infrastructure and third-party services.
Deep Analysis
Static application analysis remains one of the most effective methods for understanding what software actually contains beyond marketing claims.
Inspect Android Package Information
apkanalyzer manifest print app.apk
Decompile an APK
apktool d app.apk
Search for Embedded SDK References
grep -R "appmetrica" .
grep -R voximplant .
grep -R firebase .
grep -R mixpanel .
Extract Signing Certificate
keytool -printcert -jarfile app.apk
Display Certificate Details
apksigner verify --print-certs app.apk
Identify Network Endpoints
strings classes.dex | grep "http" strings classes.dex | grep ".ru" strings classes.dex | grep "yandex"
Inspect Android Permissions
aapt dump permissions app.apk
Review Manifest Configuration
aapt dump badging app.apk
Monitor Runtime Network Traffic
adb logcat
Capture Device Traffic
tcpdump -i any
These techniques allow analysts to validate application behavior independently instead of relying solely on published descriptions.
What Undercode Say
This investigation serves as a reminder that software trust should never be based exclusively on branding or app store presentation. Cryptographic signatures, embedded SDKs, and backend communications often reveal far more about an application’s origin than its marketing materials ever could.
The Belarusian signing certificate found in eSIM Plus is particularly significant because digital certificates are foundational to Android’s security model. Unlike metadata that can be modified in a store listing, certificates provide a stronger technical link between software and its publisher.
Equally important is the discovery of live Russian analytics and communication infrastructure inside eSIM Plus. While using Russian-hosted services is not, by itself, evidence of malicious intent, undisclosed routing of analytics and voice communications raises legitimate questions about transparency, user awareness, and data governance.
Nicegram presents a more nuanced picture. The analyzed version lacked the Russian SDKs found in eSIM Plus, illustrating why every application build should be evaluated individually rather than assuming identical behavior across related products. Software evolves rapidly, and technical findings should always be tied to specific versions.
Another major takeaway concerns the mobile analytics ecosystem itself. Many popular applications include numerous SDKs from multiple vendors. Each additional SDK increases complexity, expands data collection capabilities, and introduces new trust relationships that users rarely understand.
This case also demonstrates the importance of software supply chain analysis. Developers increasingly depend on third-party frameworks for analytics, payments, messaging, subscriptions, and cloud functionality. Security professionals must evaluate not only proprietary code but also every external dependency.
The research further highlights a transparency gap within mobile app marketplaces. Users often believe that a listed publisher fully represents the application’s development and infrastructure. In reality, ownership, code development, signing entities, backend hosting, and data processors may involve several organizations across different jurisdictions.
From a cybersecurity perspective, reverse engineering remains one of the most reliable methods for independently verifying application claims. Static analysis, certificate inspection, permission auditing, and network monitoring continue to be essential tools for researchers investigating software integrity.
Organizations operating within regulated markets, especially those handling communications or personal data, may increasingly face demands for greater disclosure regarding software provenance, infrastructure providers, and international data flows.
Ultimately, this report encourages both developers and platform operators to embrace greater openness. Transparency strengthens trust, while hidden infrastructure, even when technically legitimate, often generates unnecessary suspicion once uncovered.
✅ Confirmed: The analyzed eSIM Plus package contains a Belarusian signing certificate identifying “Mobyrix, Minsk,” according to the researchers’ reverse engineering findings.
✅ Confirmed: The examined version of eSIM Plus includes active integrations with Yandex AppMetrica and Voximplant, while the analyzed Nicegram build did not contain those specific SDKs.
✅ Context Required: The technical findings demonstrate infrastructure and development relationships, but they do not, by themselves, prove malicious behavior or unlawful data handling. The report primarily highlights transparency and disclosure concerns rather than direct evidence of cyber espionage.
Prediction
(+1) Greater regulatory scrutiny of mobile application supply chains is likely over the coming years. App marketplaces may introduce stronger requirements for publisher transparency, software signing disclosures, and third-party SDK reporting. As independent security researchers continue performing binary analysis, users and regulators alike will increasingly demand clearer visibility into who builds applications, where user data travels, and which external services operate behind the scenes.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
