Espionage is highly unlikely since nobody important will buy cheapest of the cheap dumb phones. Most likely it's used for CC theft, spam, proxying, forcing unwanted paid subscriptions, and other scamming schemes. That DEXP is involved is especially interesting because it's a face brand for DNS, a large Russian retailer. While all these models are Chinese OEM phones with a label slapped on them and little to no modification otherwise, it's possible that DNS is involved.

I also want to mention that "Russian hacker groups don't do cybercrime at home, and the state lets them do it abroad" meme, which half of HN seems to sincerely believe, is extremely misguided, and just sounds bizarre to anyone who follows the topic. There is a continuum of loosely related Russian-speaking criminals in Russia, Ukraine, Belarus, Kazakhstan, and Baltic States (mostly Lithuanian criminals who traditionally work as the EU bridge for others), and it's always hard to tell who located where. Some of them have some ties with the Russian state (regardless of the country of origin), most don't. Domestic cybercrime is rampant in Russia, often involves big names (such as top 3 mobile operators in Russia) and the mere notion it's controlled in some way is ridiculous. The only issue is there's not much money to steal, so they turn to EU and US targets.