A big reason for obligatory codesigning and developer accounts for mobile apps has been that we would know _who_ is doing malicious things, right? So... are there lawsuits already? Will someone go to jail? Or at the very least, has the developer been booted from Google Play? (No, not as of now; I reported the app, but I doubt that is a usable venue for cases like this.)
This is probably the GRU or the SVR running a deployment of this app from a shell company, together with some ad campaign. Or perhaps Chinese intelligence. Turkmenistan, like many other *stans, are currently being non kinetically fought over by China and Russia, a playground of the game of empires. These countries used to be under the Russian protectorate, but then Putin blundered so badly in Ukraine that it would be a shame not to challenge him. I'm not knowledgeable on the situation in each of the former Soviet *stans, but the general picture is pretty clear.
There's another story on HN today, the famous story of CIA setting up shell companies to buy Soviet titanium for the SR-71. The Soviet counterintelligence was completely fooled. This stuff is bread and butter for the more aggressive intelligence departments around the world.
I think that shit like this should be reported to law enforcement, so that they can route it to national intelligence or counterintelligence. They can decide to shut it down or investigate further. Opening the case in public let's the other side do a quick cleanup.
