FSB uses special spyware called Monokle to spy on political threats and such
https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf
"As we delved into applications that were related to both STC and Monokle, we came across a small subset of Android
applications signed with the same certificate"
One of the packages mentioned was com.wxy.vpn
How did this happen?
lookout-discovers-monokle-threat-report.pdf