Keenadu: Firmware-Level Android Supply Chain Backdoor via Zygote Process Injection — Threadlinqs Intelligence
As of 2026-05-30, Keenadu: Firmware-Level Android Supply Chain Backdoor via Zygote Process Injection is a high-severity supply chain threat attributed to Hangzhou Denghong Technology Co. (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 50 indicators of compromise.
Threat ID: TL-2026-0251 · Severity: HIGH · CVSS: 7.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: Hangzhou Denghong Technology Co. · China · FINANCIAL
Keenadu is a sophisticated firmware-level backdoor embedded in libandroid_runtime.so during the Android device build phase, injecting into the Zygote process to gain total control over every
Keenadu represents a deeply sophisticated Android supply chain compromise that operates at the firmware level, making it extraordinarily difficult to detect and remove through conventional mobile security tools.
INFECTION MECHANISM: The backdoor is embedded during the firmware build phase through a malicious static library (libVndxUtils.a, MD5: ca98ae7ab25ce144927a46b7fee6bd21) that is linked with libandroid_runtime.so — a critical Android shared library loaded at boot time. The malicious library masquerades as legitimate MediaTek code, targeting MediaTek chipset devices via build paths vendor/mediatek/proprietary/external/libutils/arm/libVndxUtils.a and vendor/mediatek/proprietary/external/libutils/arm64/libVndxUtils.a. In several confirmed cases, the compromised firmware was delivered through digitally signed OTA updates, meaning even users who update their devices may receive the backdoor.
ZYGOTE INJECTION: Once active, the malicious code injects itself into the Zygote process — the parent process for all Android applications. This architectural positioning means a copy of the backdoor is loaded into the address space of every application upon launch. The entry point function __log_check_tag_tag_count hooks the println_native method to execute the malicious payload.
MULTI-STAGE ARCHITECTURE: The backdoor operates as a multi-stage loader. Stage 1 uses RC4 decryption to extract an embedded payload, outputting it to /data/dalvik-cache/arm[64]/system@framework@vndx_10x.jar@classes.jar. Stage 2 uses DexClassLoader to execute the payload via com.ak.test.Main. Stage 3 branches based on process context: in the system_server process, it creates AKServer (a malicious system service with full privilege escalation capabilities); in all other processes, it creates AKClient (a client interface for targeted payload delivery).
PRIVILEGE ESCALATION: The AKServer component can grant arbitrary permissions to apps, revoke any permission, retrieve geolocation data, and exfiltrate device information — all without user interaction. It exposes malicious Binder interfaces (com.action.SystemOptimizeService and com.action.SystemProtectService) for inter-process communication.
PAYLOAD MODULES: Keenadu downloads and deploys multiple second-stage modules targeting specific applications:
- Keenadu Loader: Targets Amazon, Shein, and Temu for shopping cart manipulation and fraud
- Clicker Loader: Targets YouTube, Facebook, and Digital Wellbeing for ad element interaction
- Chrome Module: Monitors the URL bar, intercepts search queries and autocomplete suggestions, redirects to attacker-controlled search engines
- Nova (Phantom) Clicker: Uses machine learning-based ad detection and WebRTC for automated ad fraud
- Install Monetization: Hijacks the system launcher to track app installations and spoof ad attribution clicks
- Google Play Module: Harvests Advertising IDs
- BADBOX Variant Loader: Secondary dropper connecting to the BADBOX botnet infrastructure
- Credential Stealer: Targets Telegram and Instagram authentication data, with WhatsApp support prepared but unused
EVASION TECHNIQUES: The malware implements multiple evasion mechanisms including a 2.5-month delay before accepting C2 payloads, termination when running in Google services or carrier apps (Sprint, T-Mobile), abortion in Chinese language/timezone environments, and multi-layer encryption using RC4, AES-128-CFB, and XOR with DSA code signing for module authentication.
C2 INFRASTRUCTURE: Command and control communication uses Alibaba Cloud CDN infrastructure, with primary domains keepgo123.com, gsonx.com, and trends.search-hub.cn. The C2 protocol uses encrypted JSON payloads containing download links, MD5 hashes, and target package names, communicating via API endpoints /ak/api/pts/v4 (device registration), /ota/api/tasks/v3 (task retrieval), and /terminal/client/register (BADBOX registration).
DISTRIBUTION VECTORS: Beyond firmware pre-installation, Keenadu spreads through trojanized Goog
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: consumer-electronics, enterprise-byod, e-commerce, telecommunications, government, education
Target regions: Russia, Japan, Germany, Brazil, Netherlands, North America, Europe, Asia-Pacific, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 50 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195, T1106, T1129, T1547, T1542, T1055, T1548, T1027, T1036, T1140