DNS Analysis of the Keenadu Backdoor Network

A backdoor dubbed “Keenadu” has been identified in the firmware of certain Android devices, likely introduced through a malicious static library linked with libandroid_runtime.so during the firmware build process or delivered via compromised OTA updates. The malware acts as a multistage loader, enabling remote control of infected devices and supporting activities such as search hijacking and app monetization.

Securelist identified¹ several IoCs associated with the threat. Building on these, we analyzed 29 refined IoCs, leading to these findings:

• 339 unique client IP addresses communicated with three of the domains tagged as IoCs
• Three of the domains dubbed as IoCs seem to have been registered with malicious intent from the get-go
• 61 distinct potential victim IP addresses communicated with two of the IP addresses named as IoCs
• 80 email-connected domains, 12 of which turned out to be malicious
• Eight additional IP addresses, four of which have already been weaponized for various attacks
• 52 IP-connected domains, two of which already figured in malicious campaigns
• 69 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://securelist.com/keenadu-android-backdoor/118913/