Kaspersky Finds Keenadu Android Malware in Firmware and Fake Apps
Summary
Kaspersky reports Keenadu in Android firmware and fake camera apps, with detections on roughly 13,000 devices. The malware enables remote control and appears mainly used for ad fraud; researchers also found a connection to BadBox.
Key points
- Keenadu was found in firmware from various Android device brands, particularly tablets; researchers say it may be injected during development or delivered through OTA updates.
- The backdoor gives operators remote control and appears mainly used to hijack browser searches, monetize app installs, and click ads.
- Kaspersky also found Keenadu distributed as fake smart camera apps through app stores; the identified Google Play apps had more than 300,000 downloads before removal.
- Kaspersky products detected infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands.
- Researchers reported a connection between Keenadu and BadBox, and links among Triada, Vo1d, and BadBox; they cautioned that these links do not establish direct connections between every botnet.
Article Details
- Event Type
- Discovery of Keenadu Android backdoor and reported links to Android botnets
- Impact
- Keenadu can remotely control infected Android devices and appears to be used mainly for ad fraud, including hijacking browser search engines, monetizing app installs, and clicking ads. It has been found in device firmware, including through OTA updates, and in apps disguised as smart camera apps. Kaspersky reported that its products detected infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands. Fake apps identified on Google Play had more than 300,000 downloads before removal. Researchers reported a connection between Keenadu and BadBox, while cautioning that links between botnets are not necessarily transitive.
MITRE ATT&CK
Malware
BADBOXThe researchers have found links between Keenadu and several massive botnets largely powered by low-cost Android devices, including Triada, Vo1d, and BadBox.KeenaduDubbed Keenadu, the backdoor has been found in the firmware of various Android device brands, particularly tablets.TriadaThe researchers have found links between Keenadu and several massive botnets largely powered by low-cost Android devices, including Triada, Vo1d, and BadBox.Vo1dThe researchers have found links between Keenadu and several massive botnets largely powered by low-cost Android devices, including Triada, Vo1d, and BadBox.
Vendors
Googlebut the security firm has also seen it being distributed through various application stores (including Google Play and Xiaomi GetApps) disguised as smart camera apps.KasperskyResearchers at Kaspersky have analyzed a recently discovered Android malware that enables its operators to remotely control compromised devices.Xiaomifirm has also seen it being distributed through various application stores (including Google Play and Xiaomi GetApps) disguised as smart camera apps.
Products
AndroidResearchers at Kaspersky have analyzed a recently discovered Android malware that enables its operators to remotely control compromised devices.Google Playbut the security firm has also seen it being distributed through various application stores (including Google Play and Xiaomi GetApps) disguised as smart camera apps.Xiaomi GetAppsfirm has also seen it being distributed through various application stores (including Google Play and Xiaomi GetApps) disguised as smart camera apps.
Countries
BrazilThe security firm’s products have detected Keenadu malware infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands.GermanyThe security firm’s products have detected Keenadu malware infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands.JapanThe security firm’s products have detected Keenadu malware infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands.NetherlandsThe security firm’s products have detected Keenadu malware infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands.RussiaThe security firm’s products have detected Keenadu malware infections on roughly 13,000 devices, mainly in Russia, Japan, Germany, Brazil, and the Netherlands.