As reported by Security Affairs, the Mysterium VPN Research Team's technical analysis of two widely distributed consumer apps — eSIM Plus and Nicegram — has uncovered deeply troubling connections to Belarusian development infrastructure and Russian data routing. This story deserves far more attention than it has received, particularly among enterprise security teams and government agencies operating within EU jurisdictions.

Threat Intelligence: As reported by Security Affairs, the Mysterium VPN Research Team's technical analysis of two widely distributed consumer apps — eSIM Plus and Nicegram — has uncovered deeply troubling connections to Belarusian development infrastructure and Russian data routing.

Why This Finding Matters Beyond the Headline

The geopolitical dimension here is not incidental — it is the story. Belarus and Russia operate under a unified state security framework. The KGB of Belarus has maintained documented cooperation agreements with Russia's FSB, meaning any application with infrastructure entanglements in either country must be evaluated through that lens. When an app presents itself as Lithuanian — a NATO and EU member state — while silently routing communications through Russian services, that is not a branding oversight. It is a structural deception that raises legitimate questions about intent.

With Nicegram exceeding 50 million downloads and eSIM Plus topping 1 million installs, the potential exposure surface is substantial. Nicegram is particularly significant because it functions as an alternative Telegram client — meaning it may handle private messages, channel memberships, and contact lists for millions of users who believe they're operating in a Western-controlled application environment. eSIM Plus compounds this risk by handling mobile identity data — a category of information that is extraordinarily sensitive from both a surveillance and identity theft perspective.

The "Lithuanian Wrapper" Problem

This case exemplifies an emerging pattern Shield53 has tracked across the app ecosystem: jurisdiction laundering. Developers with ties to adversarial states register legal entities in EU or Western countries, obtain legitimate app store listings under those favorable jurisdictions, and distribute software whose actual engineering, infrastructure, and data exposure remains anchored in less friendly environments. App store vetting processes — even Apple's relatively rigorous review — are not equipped to detect shared codebases or backend data routing at the level this analysis uncovered.

Key risk indicator: When an app's stated country of origin, its actual codebase provenance, and its data routing infrastructure do not align, treat that divergence as a red flag requiring investigation — not a minor administrative inconsistency.

Who Is Most at Risk

The "Lithuanian Wrapper" Problem
Government and defense personnel using personal devices with either app installed — even casually — may expose metadata, contact graphs, and communication patterns
Journalists and activists in EU countries who rely on Nicegram for its privacy-forward reputation face a potentially false sense of security
Enterprise employees with BYOD policies who have installed eSIM Plus for international travel could be routing corporate call data through Russian telecommunications infrastructure
EU citizens broadly subject to GDPR protections whose data may be processed in jurisdictions with no meaningful data protection equivalence

The eSIM Threat Vector Specifically

eSIM technology deserves special scrutiny in this context. Unlike traditional SIM cards, eSIM profiles are provisioned digitally and can theoretically be manipulated remotely. An eSIM management application with opaque backend infrastructure represents a privileged attack surface — one that sits at the intersection of mobile identity, carrier authentication, and physical location. If eSIM Plus's routing infrastructure passes through Russian services, questions about profile data interception, IMSI exposure, and call metadata retention are entirely legitimate and urgent.

Shield53 Recommendations

For Enterprise Security Teams

  • Audit MDM/MAM policies immediately — add eSIM Plus and Nicegram to your blocklist or restricted application registries pending further vendor transparency
  • Review BYOD acceptable use policies to explicitly address apps with adversarial-state infrastructure entanglements, not just apps with known malware signatures
  • Conduct a mobile threat defense (MTD) review — solutions like Lookout, Zimperium, or Microsoft Defender for Endpoint on mobile can flag anomalous data routing behavior
  • Brief privileged users — executives, IT admins, and anyone with access to sensitive systems should be made aware of this specific finding

For Individual Users

  • Uninstall both applications until independent verification of data handling claims is available
  • If you used Nicegram as a Telegram client, review your active Telegram sessions (Settings → Devices) and terminate any unrecognized sessions
  • Do not assume app store presence — even in Apple's App Store or Google Play — guarantees operational safety or accurate jurisdiction claims

For Policy and Regulatory Teams

  • This case is a compelling argument for mandatory data flow transparency requirements in EU app store submissions — GDPR's existing mechanisms are insufficient to catch infrastructure-level deception at vetting time
  • ENISA and national CERTs in EU member states should be briefed on the Mysterium Research Team's methodology for broader application across app ecosystem monitoring

The broader lesson is one Shield53 continues to emphasize: provenance is a security control. Knowing where your software comes from, who built it, and where it sends your data is not optional due diligence — it is a foundational element of modern threat modeling. This analysis demonstrates exactly why.