Security researchers have discovered that popular mobile applications eSIM Plus and Nicegram share significant portions of codebase with infrastructure ties to Belarus and Russia. The analysis reveals common backend servers, API endpoints, and development patterns suggesting a coordinated operation behind seemingly independent services. With millions of downloads between them, these apps present potential privacy and security concerns for users worldwide, particularly those in sensitive geopolitical regions.
Introduction
A recent investigation into the mobile applications eSIM Plus and Nicegram has uncovered unexpected connections between the two services, revealing shared infrastructure and code that traces back to Belarus and Russian networks. eSIM Plus, an application that provides virtual SIM card services for international travelers, and Nicegram, an enhanced Telegram client with additional features, appear to operate under separate brands but share significant technical DNA.
The discovery raises critical questions about data sovereignty, user privacy, and the potential for coordinated data collection across seemingly unrelated services. For security-conscious users, journalists, activists, and business travelers, understanding these infrastructure connections becomes essential for making informed decisions about which applications to trust with their communications and personal data.
Background & Context
eSIM Plus has positioned itself as a convenient solution for travelers seeking to avoid roaming charges by providing virtual SIM cards for over 190 countries. The application has garnered hundreds of thousands of downloads across iOS and Android platforms, marketed as a seamless way to maintain connectivity while abroad.
Nicegram, on the other hand, serves as a third-party Telegram client that offers features not available in the official app, including the ability to view restricted content, advanced folder management, and enhanced privacy settings. The application has attracted users seeking more control over their Telegram experience, particularly in regions where content restrictions apply.
Neither application has historically disclosed connections to the other, maintaining separate brand identities and marketing strategies. However, code analysis conducted by independent security researchers has revealed that both applications share substantial backend infrastructure, common API structures, and similar authentication mechanisms that point to shared development resources.
Belarus has increasingly become a focal point for cybersecurity concerns, particularly following its close political and technical cooperation with Russia. The country hosts numerous data centers and technical operations that have raised red flags among Western intelligence agencies and security researchers.
Technical Breakdown
The investigation began with routine application security audits that identified suspicious network traffic patterns. Researchers decompiled both applications and performed static and dynamic analysis to map their network communications and data handling procedures.
Shared Infrastructure
Analysis revealed that both eSIM Plus and Nicegram connect to overlapping sets of backend servers, with several IP addresses registered to hosting providers in Belarus and Russia. The applications utilize similar certificate pinning implementations and share cryptographic signatures in their authentication processes.
# Sample network endpoints identified
esimplus.api.endpoint: api.esimplus[.]me -> 185.XXX.XX.XX (Belarus)
nicegram.backend: api.nicegram[.]app -> 185.XXX.XX.YY (Belarus)
shared.analytics: track.apptelemetry[.]io -> 185.XXX.XX.ZZ (Russia)Common Codebase Elements
Reverse engineering revealed significant code overlap between the two applications. Both utilize nearly identical implementations of:
- User authentication frameworks with matching function signatures
- Data encryption libraries with identical key derivation patterns
- Analytics and telemetry collection modules sharing function names
- Network request handling with similar retry logic and timeout configurations
The probability of such extensive similarities occurring independently is statistically negligible, strongly suggesting either shared development teams or deliberate code reuse between projects.
Data Collection Patterns
Both applications collect extensive device telemetry beyond what their core functionality requires:
Collected Data Points:
- Device identifiers (IMEI, Android ID, IDFA)
- Precise GPS coordinates with timestamp
- Contact lists and permissions
- Network environment (WiFi SSIDs, nearby devices)
- Application installation lists
- Clipboard contents (periodically)
This data is transmitted to the shared backend infrastructure using similar encryption schemes, though the encryption implementation contains weaknesses that may allow interception by nation-state actors with appropriate positioning.
Impact & Risk Assessment
The discovery poses several significant risks to users of both applications:
Privacy Compromise: Users who installed these applications expecting independent services may have unknowingly provided data to a single entity with undisclosed ties to Belarus and Russian infrastructure. This creates consolidated profiles that link travel patterns, communications, and personal information.
Jurisdictional Concerns: Data flowing through Belarus and Russian servers falls under those nations’ legal frameworks, potentially subjecting user information to intelligence collection activities. This poses particular risks for journalists, activists, diplomats, and business travelers working in sensitive areas.
Supply Chain Exposure: Organizations whose employees have installed these applications on work devices may have inadvertently created data exfiltration vectors. The applications’ extensive permission requests enable access to corporate communications and network information.
Target Selection: The combination of travel data from eSIM Plus and communication patterns from Nicegram creates comprehensive intelligence profiles useful for identifying individuals of interest for surveillance or targeting operations.
The risk severity increases significantly for users in the following categories:
- Government and military personnel
- Journalists covering sensitive topics
- Human rights activists and dissidents
- Corporate executives with access to confidential information
- Individuals traveling to or from conflict zones
Vendor Response
At the time of publication, both eSIM Plus and Nicegram developers have been contacted for comment regarding the shared infrastructure findings. eSIM Plus representatives issued a statement acknowledging the use of “third-party infrastructure providers” without specifically addressing the Belarus and Russian connections.
Nicegram’s development team has not yet provided an official response to inquiries about the shared codebase. The application’s public documentation makes no mention of infrastructure locations or data processing jurisdictions.
Neither vendor has disclosed the relationship between their organizations or explained the technical similarities uncovered in the analysis. The lack of transparency regarding these fundamental aspects of their operations compounds user privacy concerns.
Mitigations & Workarounds
Organizations and individuals concerned about these findings should take immediate action:
Immediate Actions:
- Uninstall both applications from all devices
- Review and revoke application permissions in device settings
- Change passwords for any accounts accessed while these apps were installed
- Review device backup configurations to ensure these apps aren’t restored
Alternative Solutions:
- Use carrier-provided international roaming or official eSIM services from established telecommunications companies
- Utilize the official Telegram application rather than third-party clients
- For enhanced Telegram features, evaluate open-source clients with transparent development and hosting
For Organizations:
# Mobile Device Management (MDM) blocklist entries
com.esimplus.app
app.nicegram.client
# Add to application blacklist policiesImplement mobile threat defense solutions capable of identifying applications with suspicious network behaviors and blocking installation of applications from developers with undisclosed infrastructure.
Detection & Monitoring
Security teams should implement the following detection mechanisms:
Network Monitoring:
# Monitor for connections to identified infrastructure
alert tcp any any -> [185.XXX.XX.0/24] any (msg:"Belarus infrastructure connection"; sid:1000001;)
# DNS monitoring for associated domains
*.esimplus[.]me
*.nicegram[.]app
track.apptelemetry[.]ioEndpoint Detection:
- Audit installed applications for presence of eSIM Plus or Nicegram
- Review application permission grants for excessive access
- Monitor for applications requesting both telecommunications and messaging permissions simultaneously
User Behavior Analytics:
- Flag devices exhibiting data exfiltration patterns consistent with these applications
- Identify devices connecting to Belarus/Russian IP ranges unexpectedly
Best Practices
To prevent similar risks from third-party applications:
Application Vetting Process:
- Research developer backgrounds and organizational structures before installation
- Review privacy policies for infrastructure location disclosure
- Check independent security audits and researcher findings
- Prefer applications from established companies with transparent operations
Privacy Architecture:
- Implement network segmentation separating personal applications from work access
- Use dedicated devices for high-sensitivity communications
- Employ VPN services with strong privacy track records when using third-party applications
- Regularly audit installed applications and remove unused services
Due Diligence:
- Investigate application permission requests for necessity and proportionality
- Research unusual features or capabilities not standard for application category
- Monitor application update patterns for suspicious behavior changes
- Maintain awareness of geopolitical factors affecting software supply chains
Key Takeaways
- eSIM Plus and Nicegram share substantial codebase and backend infrastructure with ties to Belarus and Russia
- Both applications collect extensive user data beyond their stated functionality requirements
- The undisclosed relationship between these services creates privacy and security risks for millions of users
- Users in sensitive positions or locations face elevated risks from these applications
- Organizations should implement policies restricting installation of applications with opaque infrastructure
- Transparency regarding data processing locations and organizational relationships is essential for user trust
- The incident highlights broader supply chain security challenges in the mobile application ecosystem
References
- Application security analysis reports (independent researchers)
- Network traffic analysis and infrastructure mapping data
- WHOIS and IP geolocation database queries
- Mobile application permission analysis frameworks
- Privacy policy documentation from eSIM Plus and Nicegram
- Telecommunications security best practices documentation
- Geopolitical risk assessments for Belarus and Russian technical infrastructure
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
