InterSecLab: Russia's mandated Max messenger has no end-to-end encryption

From 1 September 2025, new phones and tablets sold in Russia ship with VK's Max messenger. InterSecLab's review of Android 26.12.0 (build 6664, package ru.oneme.app) found no end-to-end encryption, plaintext contact uploads, and server-controlled network probes.

Nationwide preinstall

From 1 September 2025, new phones and tablets sold in Russia ship with Max. VK began the project in March 2025 as a domestic substitute after Western sanctions. In June 2025 President Vladimir Putin signed a law setting the promotion framework. The app combines messaging with state services, digital identity, and AI features, including payments and identity checks.

Signal was blocked in August 2024. WhatsApp was blocked in February 2026 and dropped from Russian national DNS. Telegram has faced mass blocking since mid-March 2026.

VK Group develops Max. Gazprom-linked entities hold the equity. The operating company was renamed OOO MAX in January 2026. InterSecLab analyzed Android 26.12.0, build 6664, package ru.oneme.app.

SORM and TSPU

Operators and information services must give the FSB technical access under SORM. Roskomnadzor can install deep packet inspection equipment in operator networks under TSPU to filter and throttle traffic.

Encryption

Max uses Russian federal-standard cryptography from a vendor with an FSB license. The app exits within seconds if it detects Frida. Hostnames are stored as scrambled integer arrays. Servers refuse connections that do not negotiate Russian cipher suites.

InterSecLab found no end-to-end encryption. VK servers can read messages in plaintext. The secret chat label is a disappearing-message timer with no cryptographic protection. Telegram historically used the same phrase for its end-to-end mode.

Each text message includes a flag telling the server to inspect links and shared content. Signal builds link previews on the device. Max has the server parse the text.

Contacts and lookup

Registration asks for contacts with only an Allow button. The prompt repeats until consent. The full address book then uploads to VK in plaintext as number-and-name pairs. On a new account, numbers were visible in cleartext. Code that looked like hashing only stripped non-digits, dropped country prefixes, and rewrote a leading 8 as 7.

Any registered number can be queried without friendship, without notifying the target, and without an observed rate limit. The server returns internal ID, nickname, creation time, and last profile update. Within 1.2 seconds it pushes live online status for 15.5 minutes and creates a chat object linking the two accounts even if they never spoke.

Voice and on-call models

Sent and received voice notes are transcribed on VK servers using TRANSCRIBE_MEDIA and NOTIF_TRANSCRIPTION. Observed jobs were user-started. Automatic transcription was not confirmed.

Call audio is passed to a machine-learning model on the phone. The model is fetched at runtime from a server URL, checked against a server checksum, then run. The pipeline can load TensorFlow Lite models from VK. The model seen in testing listened for "не слышу" (cannot hear) as a quality signal and reported a confidence score. The phrase list can change without an app update.

Network probes

On each open or backgrounding, Max checks public IP via up to six external services, VPN presence, operator, and reachability of a service list, then reports to VK. IPs can indicate location and refresh every launch. Targets included Max servers, Google static CDN, Google Cloud Messaging, Odnoklassniki CDN, and gosuslugi.ru. Older builds also tested Telegram and WhatsApp. After March 2026 reporting, VK removed those two from the active list and left the code in the binary. Reachability of those apps can mark a device as outside Russia's filtered network and, with operator and IP, can show which operators enforce blocks.

A second module, DPS (package ru.trace_flow.dps), reports to trace-flow.ru with its own client and credentials. The hostname is stored scrambled. The phone fetches an unrestricted target list that may include ports, then tests DNS, TCP, and TLS, reporting account ID, device ID, apparent IP, operator, and VPN state on a server-set schedule. The flag defaults off but was on for the test account. In 26 days of captures it contacted the host 19 times on 21 April, 14 May, and 22 May 2026. Inferred targets included Max API and call infrastructure, gosuslugi.ru, and Google, Apple, and Huawei push endpoints. The Apple address was not in the binary as a string.

trace-flow.ru resolved to three addresses in AS47764, registered to Moscow LLC VK. The TLS certificate was issued to Moscow VK LLC by GlobalSign.

Feature flags and VPN

Probes, VPN detection, transcription, log level, and identity sharing are gated by per-account server flags with no app update and no UI notice.

In an April 2026 test, Max blocked sending behind a full-screen demand to disable VPN. A tunnel on a router with no VPN interface on the phone did not trigger the prompt. Detection looks for a local VPN interface.

TamTam heritage

Max inherits protocol and code from TamTam, Mail.ru's 2016 Odnoklassniki chat product. Packages include ru.ok.tamtam. Traffic remains a proprietary MessagePack binary format over TLS. Transport moved to GOST TLS on api-gost.oneme.ru. The cipher is Kuznyechik (GOST R 34.12-2015, RFC 7801), implemented by CryptoPro under an FSB license. Content inside the tunnel is readable by VK.

The backend sits in a 4096-address IPv4 block assigned to Moscow LLC VK on 5 September 2025. Core hosts are Russia-operated and Russia-hosted. The only foreign destinations observed were public IP lookup services.

Max lists eight Android TLS exceptions: six MegaFon, MTS, Tele2, and Beeline domains for Mobile ID, plus *.gov.ru and *.voskhod.ru. Voskhod is tied to ESIA, the identity layer under Gosuslugi. Those flows may be cleartext and visible to operators and SORM equipment.