eSIM Plus and Nicegram Use Belarus‑Linked Codebase and Route Data Through Russian Services
What Happened — Security researchers dissected the Android packages of eSIM Plus (≈ 1 M downloads) and Nicegram (≈ 50 M downloads). Both apps are marketed as Lithuanian products but are cryptographically signed by a Belarus‑based entity (“Mobyrix, Minsk”). eSIM Plus also embeds live integrations with Russian services Yandex AppMetrica (analytics) and Voximplant (call routing).
Why It Matters for Compliance & Audit Readiness
- The shared, foreign‑origin codebase is a classic third‑party supply‑chain risk that SOC 2 vendor‑management controls are designed to identify, assess, and continuously monitor.
- Routing user data and call traffic through Russian endpoints may violate data‑locality, privacy, and export‑control requirements, demanding documented due‑diligence and evidence of control effectiveness.
- Continuous monitoring of code‑signing certificates and SDK usage provides audit‑ready proof that your organization is exercising reasonable oversight of mobile‑app vendors.
Who Is Affected – Consumer‑facing mobile‑messaging and eSIM management apps; broadly, any organization that integrates or recommends these apps for employee or customer communications.
Recommended Actions
- Add eSIM Plus and Nicegram to your vendor inventory and trigger a SOC 2‑aligned third‑party risk assessment.
- Verify code‑signing certificates, SDK provenance, and data‑flow diagrams; collect evidence of any foreign‑jurisdiction data routing.
- Implement continuous monitoring of app updates and third‑party SDK changes to maintain an auditable trail. Source: SecurityAffairs
Technical Notes – The eSIM Plus package (v4.4.26) includes Yandex AppMetrica SDK (≈ 2,900 references) and Voximplant call‑routing SDK (≈ 1,700 references) communicating with .ru endpoints. Nicegram (v1.55.0) shares the same “Appvillis” codebase but lacks the Russian SDKs in the examined build. Both apps request fine‑grained location permissions and embed multiple analytics/marketing SDKs. Source: same as above