Kaspersky Finds Keenadu Backdoor in Android Tablet Firmware
Summary
Kaspersky found the Keenadu backdoor in Android tablet firmware, with over 13,700 users encountering it or related modules. The malware was primarily used for ad fraud and may require clean firmware or device replacement to remove.
Key points
- Kaspersky identified Keenadu, a previously undocumented Android backdoor embedded in tablet firmware and capable of loading into applications.
- Researchers recorded over 13,700 users encountering Keenadu or its modules; detections were highest in Russia, Japan, Germany, Brazil, and the Netherlands.
- Keenadu modules hijacked browser search engines, monitored app installations, and interacted with advertising components to generate fraudulent revenue.
- The backdoor was found in firmware from multiple manufacturers, including Alldocube; Kaspersky said some later updates for one affected model remained infected.
- Researchers believe Keenadu may have been inserted during firmware development, potentially through a compromised supply chain, but did not identify a threat actor.
- Other variants appeared in applications, including a facial recognition app and apps distributed through official and third-party stores.
- Standard Android security tools may not remove the firmware-level backdoor; researchers recommend trusted clean firmware or, in some cases, replacing the device.
Article Details
- Event Type
- Discovery of a firmware-level Android backdoor linked to a suspected supply-chain compromise.
- Impact
- Kaspersky reported more than 13,700 detections of Keenadu or its modules. The backdoor was found in tablet firmware from multiple manufacturers, including Alldocube, and could provide attackers with extensive device control. Reported capabilities included advertising fraud, browser hijacking, and monitoring app installations. Researchers said standard Android security tools cannot remove the firmware-embedded version; clean firmware or device replacement may be needed.
MITRE ATT&CK
Malware
Vendors
Products
AndroidKaspersky researchers discovered a previously undocumented Android backdoor named Keenadu embedded in tablet firmware that can infect devices before they reach consumers and grant attackers virtually unrestrictedGoogle PlayOther variants were hidden in applications, including a facial recognition app used for device unlocking, and even in apps distributed through official stores such as Google Play and third-party repositories.Google Play ServicesIt also remains inactive on devices that lack Google Play Store or Google Play Services.
Countries
BrazilResearchers recorded over 13,700 detections, with the highest numbers in Russia, Japan, Germany, Brazil, and the Netherlands.GermanyResearchers recorded over 13,700 detections, with the highest numbers in Russia, Japan, Germany, Brazil, and the Netherlands.JapanResearchers recorded over 13,700 detections, with the highest numbers in Russia, Japan, Germany, Brazil, and the Netherlands.NetherlandsResearchers recorded over 13,700 detections, with the highest numbers in Russia, Japan, Germany, Brazil, and the Netherlands.RussiaResearchers recorded over 13,700 detections, with the highest numbers in Russia, Japan, Germany, Brazil, and the Netherlands.