Keenadu Android Backdoor Found in Signed Tablet Firmware
Summary
Kaspersky says Keenadu, an Android backdoor found in signed tablet firmware and some apps, injects into Zygote, loads app-specific modules and enables remote control; telemetry recorded 13,715 encounters. Google confirmed removing three identified Play apps.
Key points
- Kaspersky reports finding Keenadu in signed tablet firmware, including Alldocube iPlay 50 mini Pro firmware dating to August 2023; the compromise reportedly occurred during firmware builds.
- The backdoor is embedded in libandroid_runtime.so and injected into the Zygote process, allowing its client component to load in launched apps.
- Keenadu uses AKServer and AKClient components to deliver app-specific modules, collect device information, access location data, and change app permissions.
- Reported modules hijack Chrome searches, interact with advertising, monetize app installs, and target online storefronts; some payload delivery is delayed until 2.5 months after initial check-in.
- Kaspersky telemetry recorded 13,715 encounters with Keenadu or its modules, mostly in Russia, Japan, Germany, Brazil, and the Netherlands.
- Kaspersky also identified distribution through trojanized apps, including three smart-camera apps on Google Play. Google said the apps were removed and that Play Protect can warn about or disable known associated apps.
Article Details
- Attack Vectors
- Keenadu was embedded in tablet firmware during the firmware build phase; compromised firmware carried valid digital signatures, and in several instances was delivered through OTA updates.
- Keenadu loader components were embedded in system apps, including the facial recognition service and system launcher.
- Trojanized smart-camera apps distributed through Google Play carried Keenadu; the article also reports standalone malicious modules distributed through third-party repositories and official app marketplaces.
- In some cases, BADBOX acted as a distribution vector for Keenadu.
- Defensive Notes
- Google said Google Play Protect is enabled by default on Android devices with Google Play Services and can warn users about and disable apps exhibiting Keenadu-associated behavior, including apps installed from outside Google Play.
- Google recommends ensuring that devices are Play Protect certified.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelKeenadu can exfiltrate device information through its AKServer and C2 architecture.T1055 · Process InjectionKeenadu is injected into the Zygote process and loaded into the address space of apps when they launch.T1082 · System Information DiscoveryKeenadu collects device metadata and device information for transmission to its server.T1105 · Ingress Tool TransferKeenadu retrieves malicious modules from its server using payload download links supplied in the server's response.T1497.003 · Time Based ChecksKeenadu delays payload delivery until 2.5 months after its initial check-in, which the article says appears intended to complicate analysis and evade detection.T1542.001 · System FirmwareKeenadu was embedded in device firmware during the firmware build phase.T1614.001 · System Language DiscoveryKeenadu's malicious modules can obtain the device's current location.
People
Malware
BADBOXprocess had already been compromised by a different pre-installed backdoor that shares similarities with BADBOX.DwphonThis tactic has been observed in another Android malware known as Dwphon, which was integrated into system apps responsible for OTA updates.KeenaduKaspersky discovered a sophisticated Android backdoor named Keenadu embedded in device firmware that can silently harvest data and remotely control infected tablets.PhantomThe same component was codenamed Phantom by Doctor Web in an analysis published last month.TriadaOnce it’s active on an infected device, it’s injected into the Zygote process, a behavior also observed in another Android malware called Triada.Vo1dIn March 2025, HUMAN said it identified overlaps between BADBOX and Vo1d, an Android malware targeting off-brand Android-based TV boxes.
Vendors
Alldocubeuses a client-server AKServer/AKClient architecture to load malicious modules, and has been observed in Alldocube firmware and other undisclosed vendors, impacting over 13,700 users worldwide.GoogleDistribution vectors include compromised firmware delivered via OTA updates, trojanized apps on Google Play, and preinstalled system apps.
Products
Alldocube iPlay 50 mini ProKeenadu has been detected in Alldocube iPlay 50 mini Pro firmware dating back to August 18, 2023.AndroidKaspersky discovered a sophisticated Android backdoor named Keenadu embedded in device firmware that can silently harvest data and remotely control infected tablets.Google ChromeIdentified modules hijack Chrome searches, manipulate ads, monetize installs, and target popular storefronts and apps.Google PlayDistribution vectors include compromised firmware delivered via OTA updates, trojanized apps on Google Play, and preinstalled system apps.Google Play ProtectAndroid users are automatically protected from known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.Xiaomi GetAppsOne of the payloads has been found embedded in several standalone apps distributed via third-party repositories, as well as official app marketplaces like Google Play and Xiaomi GetApps.
Countries
BrazilKaspersky telemetry indicates 13,715 encounters, with most victims located in Russia, Japan, Germany, Brazil, and the Netherlands.GermanyKaspersky telemetry indicates 13,715 encounters, with most victims located in Russia, Japan, Germany, Brazil, and the Netherlands.JapanKaspersky telemetry indicates 13,715 encounters, with most victims located in Russia, Japan, Germany, Brazil, and the Netherlands.NetherlandsKaspersky telemetry indicates 13,715 encounters, with most victims located in Russia, Japan, Germany, Brazil, and the Netherlands.RussiaKaspersky telemetry indicates 13,715 encounters, with most victims located in Russia, Japan, Germany, Brazil, and the Netherlands.