A highly sophisticated Android backdoor, dubbed Keenadu, has been discovered embedded at the firmware level on multiple Android device brands and also spreading via Android apps — including ones previously published on the official Google Play Store. This threat represents a notable escalation in firmware malware, blending supply-chain compromise with remote control capabilities that sidestep Android’s traditional security boundaries.
What Is Keenadu? A Deep-Level Android Backdoor
Keenadu is not a run-of-the-mill trojan. It is a backdoor platform embedded directly into a device’s firmware — often inserted during the operating system build process — which gives attackers a foothold with system-level privileges. Once active, it quietly compromises every application on the device, including both system apps and third-party software.
The malware was identified by researchers at Kaspersky, who said it affects tablets and possibly other Android devices from multiple manufacturers. The firmware-based variant is considered the most potent due to its unrestricted access and persistence.
Infection Vectors: Firmware and App Distribution
Keenadu has multiple infection vectors:
1. Embedded in Firmware at Build Time
The most significant vector is direct integration into the system firmware. During the OS build process, attackers inserted malicious code into a core Android library (libandroid_runtime.so), a shared component loaded into every running app. This allows the backdoor to load code into every process on the device.
The compromised firmware has been found on devices including the Alldocube iPlay 50 mini Pro tablet, with infected releases dating back to at least August 2023. Devices with infected firmware carry the malware deep in the system partition — rendering it extremely resistant to conventional removal.
2. Modified System Apps and Unofficial App Sources
Researchers also found Keenadu embedded within system apps, such as facial recognition or authorization services. These apps carry elevated privileges and can install or execute additional modules without user consent.
3. Google Play Store Apps
Keenadu spyware modules were also distributed through legitimate Android apps on the Google Play Store — notably smart home camera apps that together had ~300,000 downloads before removal. These apps did not trigger obvious malicious behavior on the surface; instead, they launched invisible browser tabs that accessed remote content in the background.
Technical Mechanism: How Keenadu Works
Firmware Integration
Once the infected firmware is loaded, Keenadu hooks into Android’s Zygote process — the parent of all application processes in Android. By doing so, it bypasses the OS app sandbox, enabling code to run in the context of any app without explicit permission.
During device startup, the malicious static library linked with libandroid_runtime.so is loaded and executed in memory. This loader module decrypts additional payloads, dynamically injects them into Dalvik/ART runtime memory spaces, and initiates the backdoor’s runtime components across all running apps.
Operational Capabilities
Once active, Keenadu can:
- Infect and control every installed application on the device.
- Silently install additional APKs (malicious or otherwise) and grant them arbitrary permissions.
- Intercept device data, including media, messages, credentials, and location.
- Monitor sensitive behavior — including Chrome browser search queries even in incognito mode.
Researchers noted that the firmware version does not activate if the device’s language or timezone is set to China — a possible operational exclusion that might hint at origin or targeting logic. The malware also stops if key Google components like Play Store and Play Services are absent, suggesting the attacker aims at devices within ecosystems relying on official Android services.
Comparison with Past Android Firmware Threats
Keenadu bears structural similarity to older Android threats like Triada — a backdoor family that also hooked into Zygote to infect all applications on a device. However, Keenadu appears more modular and versatile, combining deep firmware presence with dynamic remote payload execution and multi-channel distribution (including direct app deployment).
This blend of supply-chain compromise, firmware persistence, and app-level propagation elevates Keenadu beyond typical malware detected in third-party or sideloaded APKs.
Challenges in Detection and Removal
Due to its root-level persistence and systematic integration, Keenadu cannot be removed by standard Android security tools such as Google Play Protect or user-installed antivirus solutions. Since its code resides in the firmware’s read-only system partition, even a factory reset will not remove it.
Effective remediation often requires:
- Flashing a clean, trusted firmware image from the manufacturer or a trusted third-party (with caution to avoid compatibility issues).
- In some cases, device replacement when a clean firmware source is unavailable.
Kaspersky also recommends that users and administrators be cautious about devices sourced from untrusted supply chains — especially inexpensive tablets or phones whose firmware modifications might bypass manufacturer validation.
Conclusion: Firmware Malware as a Growing Threat
Keenadu underscores a broader trend in mobile threats: firmware-level malware that sidesteps Android’s sandbox and permission model and embeds control deep into the OS. Unlike typical trojans that rely on user installation or sideloading, firmware threats are far more insidious — often undetectable until triggered and resistant to conventional mitigation.
As Android devices proliferate globally, such supply-chain compromises and sophisticated malware platforms are likely to become more strategically targeted and technically advanced. Security teams should prioritize firmware integrity verification, rigorous app vetting, and trusted update channels to mitigate these emerging risks.
