Keenadu
Keenadu is an Android backdoor/multi-stage loader discovered by Kaspersky in firmware and system components of devices from multiple brands, including tablets sold with the malware already present before consumer purchase. The malware was assessed to have been inserted during the firmware build process as part of a supply-chain compromise, with tainted firmware traced back to at least August 2023 and some infections also delivered via OTA updates. Kaspersky reported Keenadu embedded into the Android core library libandroid_runtime.so via a malicious static library and injected into the Zygote process, causing a copy of the backdoor to be loaded into the address space of every app launched on the device. This gives operators effectively unrestricted remote control and allows the malware to bypass normal Android permission boundaries, persist across factory resets, and in firmware-level cases require full firmware reflashing or device replacement for remediation.
Observed capabilities include dynamic download and remote updating of additional malicious modules; ad fraud and click fraud; displaying banners on behalf of other apps; hijacking browser searches and Chrome queries, including incognito searches; tracking app installs for profit; deploying unwanted apps in pay-per-install schemes; installing hidden APKs; adding items to shopping carts; and broader data access affecting messages, media, banking data/credentials, location data, personal messages, and potentially biometrics when embedded in facial-recognition unlock apps. Kaspersky described Keenadu as currently monetized primarily through ad fraud, but noted some variants can fully control infected devices remotely. The malware has also been observed hidden in system apps such as launcher and facial-recognition services, in modified apps from unofficial sources, and in apps distributed through official marketplaces including Google Play; one report cited smart camera apps on Google Play with about 300,000 downloads that launched a Keenadu-related clicker under certain conditions.
Kaspersky reported more than 13,000 infected devices/users as of February 2026, with the highest counts in Russia, Japan, Germany, Brazil, and the Netherlands. The content links Keenadu technically and operationally to the Triada lineage and notes similarities or connections with BADBOX, Vo1d, and other Android botnet activity, though not all reporting formally attributes them to the same operator. High-confidence indicators and traits mentioned in the content include infection of libandroid_runtime.so, injection into Android Zygote, validly signed malicious firmware images, dormancy of roughly 2.5 months before fetching modules, use of AKClient/AKServer architecture, RC4-encrypted payload handling, module delivery from AWS with MD5 and DSA verification, and Kaspersky detections such as Backdoor.AndroidOS.Keenadu.a and Trojan-Downloader.AndroidOS.Keenadu.l.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
Somewhere along the supply chain — whether at the factory, through a middleman, or at a distributor — a backdoor gets injected into the firmware image.
“Android backdoor embedded directly in device firmware… inserted during the firmware build process, not after devices reached users.”
Execution
3 techniques
Execution
The pre-installed Triada.ag backdoor rose to the top spot; it is similar to the older Triada.z version we documented previously. Other pre-installed Triada variants (Triada.z, Triada.ae, Triada.ab, and Triada.ad) also made the rankings. Furthermore, we observed increasing activity from the Keenadu.a backdoor
Persistence
4 techniques
Persistence
“Keenadu was integrated directly into critical system utilities, including the facial recognition service, the launcher app… loader was found within various system apps in the firmware…”
“Some variants relied on a native library to load modules and silently install APKs… a loader… can install hidden APKs.”
Privilege Escalation
5 techniques
Privilege Escalation
“Once active on the device, the malware injected itself into the Zygote process… A copy of the backdoor is loaded into the address space of every app upon launch.”
"The Keenadu variant embedded in system apps is more limited in functionality. However, its elevated privileges allow it to install any app without alerting the user."
“Some variants relied on a native library to load modules and silently install APKs… a loader… can install hidden APKs.”
Stealth
8 techniques
Stealth
“decrypted data… using RC4… payload… loaded via DexClassLoader… C2 server addresses… Base64… gzip… AES-128… Another backdoor… single-byte XOR and executes it…”
Keenadu masquerades as legitimate system components, embedding itself even into facial-recognition unlock apps, potentially granting attackers access to biometrics, banking data, and personal messages.
“Once active on the device, the malware injected itself into the Zygote process… A copy of the backdoor is loaded into the address space of every app upon launch.”
“Upon initialization, it runs an environment check for virtual machine artifacts. If none are detected…”
“To avoid detection, the server waits about 2.5 months after activation before delivering payloads.”
“Keenadu was integrated directly into critical system utilities, including the facial recognition service, the launcher app… loader was found within various system apps in the firmware…”
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
Command and Control
4 techniques
Command and Control
"establishes a client-server architecture"; "queries C2 servers"; "Domain keepgo123.com, gsonx.com"; "Path /ak/api/pts/v4"
“encrypted data is sent to the C2 server via a POST request to the path /ak/api/pts/v4… /ota/api/tasks/v3… response… encrypted JSON object…”
Recent activity
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Firmware-level Android malware that disguises itself as legitimate system components, including facial-recognition unlock apps, enabling access to biometrics, banking data, and personal messages.
Android malware family observed in downloader and backdoor forms, with increasing activity noted for Keenadu.a.
Android malware referenced as an example of campaigns that replace system libraries to gain persistence and survive factory resets.
Firmware-embedded Android backdoor introduced during the firmware build phase; delivered in signed firmware/OTA updates; acts as a multi-stage loader and is loaded into every app’s address space on launch, enabling silent data harvesting and remote control.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.