Behind the Lithuanian Label: What's Inside Nicegram and eSIM Plus

Key Takeaways

Following OCCRP's reporting that two popular EU app store apps — Nicegram (50M+ downloads) and eSIM Plus (1M+ downloads) — are presented as Lithuanian products while allegedly developed and controlled from Belarus, the Mysterium VPN Research Team performed a static teardown of both Android packages to see what the binaries themselves reveal.

Our analysis substantially corroborates the reporting. Most decisively, the eSIM Plus package is cryptographically signed by "Mobyrix, Minsk" (a Belarusian signature on an app marketed under the Lithuanian "Appvillis" brand), and it ships live integrations with two Russian services, Yandex AppMetrica (analytics) and Voximplant (call routing, via a .ru endpoint). 

Nicegram shares the same "Appvillis" codebase and backend, though the specific Russian SDKs aren’t present in the Nicegram build we examined.

This report separates what a binary can prove (bundled SDKs, hard-coded servers, signing identity, requested permissions) from what it can’t (where data ultimately lands, full corporate structure). Findings are labeled accordingly.

Methodology

The Mysterium VPN Research Team analyzed the redistributed Android packages of Nicegram 1.55.0 (app.nicegram, versionCode 2139) and eSIM Plus 4.4.26 (com.appvillis.esim, versionCode 40426).

For each package, we unpacked the archive; decoded AndroidManifest.xml and the APK signing certificate using Androguard; extracted and searched the string tables of all DEX bytecode and bundled native libraries; and enumerated declared permissions, app components, embedded third-party SDKs, hard-coded domains and endpoints, and raw IP literals. 

Where the app pulls in an SDK, we confirmed it by class-path density and by the production network hosts it references, rather than by name matches alone (several superficial keyword hits were false positives and were discarded).

Static analysis establishes capability, composition, and signing identity. It does not, on its own, establish the exact contents of each network transmission; where that distinction matters, we say so, and note that dynamic (proxied) testing would be the next step.

Finding 1: eSIM Plus signed by Mobyrix in Minsk, Belarus

The single strongest piece of evidence sits in the eSIM Plus signing certificate. The Nicegram sample had been re-signed by Google's Play App Signing key (a consequence of third-party redistribution), which erases developer identity. The eSIM Plus package, however, retains its original developer signing certificate:

CN = Esim,  OU = Mobyrix,  O = Mobyrix,  L = Minsk,  ST = Minsk,  C = 220020

220020 is a Minsk postal code. An app publicly presented under the Lithuanian-facing "Appvillis" brand is therefore signed by Mobyrix, based in Minsk, Belarus — the concealed developer relationship the reporting describes, established here directly from the cryptographic signature rather than by inference. (Confirmed — cryptographic.)

Both apps' proprietary code is namespaced com.appvillis.*, both talk to appvillis.com, and both reference the same Voximplant "appvillis" account — evidence they come from a single development operation. (Confirmed.)

Finding 2: eSIM Plus ships Russian analytics and call-routing SDKs

• Yandex AppMetrica: eSIM Plus bundles the full io.appmetrica.analytics SDK (~2,900 code references) and communicates with Yandex infrastructure at startup.mobile.yandex.net (AppMetrica configuration/startup) and appmetrica.io (event reporting). AppMetrica is a Russian analytics platform; location tracking is wired in (setLocationTracking), and AppMetrica derives client IP server-side by design. (Confirmed.)
• Voximplant: eSIM Plus integrates the Voximplant calling SDK across a full call stack (VoximplantCallManager, VoximplantIncomingCallService, and related classes, ~1,700 references). It routes through balancer.root.voximplant.ru — a Russian (.ru) endpoint — under the account appvillis.n8.voximplant.com. (Confirmed.)

These are the two specific "leads to Russia" technical indicators named in the reporting, and both are genuinely present and wired to live production hosts.

Finding 3: The Wider Tracking Stack and Data-Collection Surface

eSIM Plus requests that users grant 35 permissions, including fine and coarse location, contacts, camera, microphone, telephony (MANAGE_OWN_CALLS, FOREGROUND_SERVICE_PHONE_CALL), storage, and the advertising ID. 

On top of AppMetrica, it carries an unusually dense identity and telemetry stack — Mixpanel, Segment, Customer.io, AppsFlyer, Facebook SDK, Firebase Analytics/Crashlytics, and Qonversion — plus a second telephony vendor (Twilio) alongside Voximplant, and payment SDKs (ecommpay, PayPal). First-party backends: esimplus.me, sms.esimplus.me, appvillis.com. (Confirmed — capability.)

Nicegram is a fork of the official Telegram Android client with the same com.appvillis layer added. It declares 73 permissions (many inherited from Telegram), including background location, contacts, microphone, camera, phone identity, and the advertising ID. Its third-party stack is Firebase/Crashlytics, Adjust, Qonversion, Google AdMob, and AppsFlyer. 

Notably, it also bundles a non-custodial crypto wallet (TON/Solana/EVM — TrustWalletCore, seed-phrase handling) and a "God's Eye" module that profiles Telegram users' activity patterns by sending channel/session data to Nicegram's servers — both meaningful privacy considerations in their own right. (Confirmed — capability.)

Finding 4: What the Nicegram Build Does Not Contain

For accuracy: the Nicegram 1.55.0 package we examined does not contain the Yandex AppMetrica SDK, does not contain Voximplant, and contains no .by endpoints or Mobyrix strings. The only Russian-hosted domains reachable from Nicegram are static-maps.yandex.ru (an optional map-tile provider inherited from upstream Telegram) and coub.com (a media-embed service) — both benign, user-action-gated, and not telemetry channels. 

This matches an independent domain-reputation scan of the app, which flagged only those two Russian-geolocated domains out of 146 and rated both clean. (Verified.)

In other words, the Russian-SDK evidence lives in eSIM Plus, not in this Nicegram build. The two apps corroborate the "same developer" claim; eSIM Plus is where the Belarusian signature and the Russian data flows are direct and technical.

Comparison

The Case for Decentralised, Trustworthy VPNs

This investigation is ultimately a story about misplaced trust. A user in the EU installs an app that presents as Lithuanian, and unknowingly routes their identifiers, location, and — in the case of eSIM Plus — their voice calls through analytics and telephony services in Russia, built and signed by a company in Minsk. Nothing in the store listing told them so. The trust was assumed; the reality was only recoverable by pulling the binary apart.

The same trust problem sits at the heart of the VPN market, and it’s more acute there than almost anywhere else. A VPN is the one piece of software a user deliberately routes all of their traffic through. If you can’t verify who operates it, where it’s incorporated, and what it does with your connection metadata, you haven’t eliminated surveillance risk; you have concentrated it into a single provider and handed them the keys.

The Nicegram/eSIM Plus case shows how easily the answers to "who runs this?" and "where does my data go?" can be obscured behind a friendly label and a favourable-sounding jurisdiction.

A centralised VPN asks you to solve that problem with faith. You’re trusting: 

1. That the company is who it says it is;
2. That its stated no-logs policy is real and honoured; 
3. That its ownership and jurisdiction haven't quietly changed; 
4. That a single set of servers under one operator's control isn't logging, correlating, or handing over your activity. 

Every one of those is an assumption, and this report is a concrete demonstration of how wrong such assumptions can turn out to be — the "Lithuanian" app that was really signed in Minsk is the VPN transparency problem in miniature.

A decentralised VPN is designed to remove those assumptions rather than ask you to accept them:

• No single operator to trust or subvert: Traffic is served by a distributed network of independent nodes instead of one company's server fleet. There’s no central choke point that can log every user, and no single entity whose hidden ownership or jurisdiction silently compromises everyone at once.
• No central honeypot of user data: In a P2P model, there’s no master database of who connected, when, and to what — the very correlation surface that centralised providers (and the analytics stacks documented above) accumulate simply doesn’t exist in one place.
• Verifiability over promises: Open-source clients and on-chain, auditable payment and node records let anyone check how the system behaves, rather than relying on a marketing claim. The lesson of this teardown is precisely that you should be able to inspect and verify software rather than trust its label; decentralised, open systems are built to be checked.
• Jurisdictional resilience: Distributing infrastructure across many operators and countries means no single government or corporate parent can compel the whole network to log or hand over data. Contrast that with an app whose real controller and data destinations turned out to be a single company in a single high-risk jurisdiction.
• Aligned incentives: When node operators are paid per unit of bandwidth for relaying traffic — not for harvesting and monetising behavioural data — the business model stops depending on the surveillance that centralised free and "freemium" apps rely on. The dense advertising-and-analytics stacks found in both apps analysed here exist because someone is monetising the user; decentralisation changes who the customer is.

This is the model the Mysterium Network is built on: a peer-to-peer, node-based VPN where no central party sees the whole picture, the client is open to inspection, and trust is replaced by verifiability. 

The apps in this report are a reminder of why that matters. Privacy tools that require blind faith in an opaque operator reproduce the exact risk they claim to solve. The answer to "can I trust this app?" shouldn’t have to be a reverse-engineering project — it should be verifiable by design.

Conclusion

The Mysterium VPN Research Team finds the OCCRP reporting well-supported by the applications' own binaries. The concealed Belarusian development link isn’t merely circumstantial in eSIM Plus — it’s written into the app's signing certificate as Mobyrix, Minsk — and the app actively integrates the Russian services (Yandex AppMetrica, Voximplant) cited in that reporting, reaching Russian-hosted infrastructure. 

Nicegram shares the same development operation and a broad data-collection footprint, but doesn’t itself ship those Russian SDKs in the version analyzed.

For users, the practical takeaway is that an app's store-listed "publisher" and country can differ materially from who actually builds, signs, and receives data from the software — a gap that’s invisible in the store listing but legible in the package itself.

Limitations and Next Steps

Static analysis proves SDK presence, hard-coded endpoints, requested permissions, and signing identity. It does not prove the exact payload of each transmission or the final storage location of collected data. 

Confirming precisely what’s sent to appmetrica.io, *.voximplant.ru, and the appvillis.com/esimplus.me backends would require dynamic analysis through an intercepting proxy, plus DNS/WHOIS/hosting attribution of those endpoints — the recommended follow-up to this teardown.

Prepared by the Mysterium VPN Research Team. Analysis covers redistributed Android packages of Nicegram 1.55.0 and eSIM Plus 4.4.26; some behavior is gated by server-side configuration and may vary across releases.