August 3, 2017 By Mark Samuels 2 min read

The Triada Trojan has been found in the firmware of various low-cost Android devices, which could be used to steal sensitive data and run cyber espionage modules.

The Trojan, called Android.Triada.231, was discovered by Dr. Web researchers. Entrenched in the source code of the libandroid_runtime.so system library, the malware infiltrates application processes, and can covertly download and run further malicious modules.

How Does the Triada Trojan Work?

Triada is an advanced form of malware that can insert itself into Zygote, which is an essential system component used to run programs, reported SecurityWeek. By infecting Zygote, the Trojan can launch malicious modules without the user’s knowledge.

Since it is embedded in the libandroid_runtime.so system library, the Triada Trojan is present in the memory of all running apps. This enables it to penetrate the processes of all apps without root privileges.

After the initialization process, Triada sets up some boundaries: The malware creates a working directory and checks the running environment. If the environment is suitable, it intercepts a system method, tracks the initialization of applications and performs malicious actions.

How Dangerous Is the Malware?

Dr. Web researchers reported that Triada can be used to surreptitiously download additional modules. These Trojans may run malicious plugins that allow cybercriminals to steal sensitive data from bank applications, initialize cyber espionage modules and interrupt social media conversations.

Triada can also be used to extract the encrypted module Android.Triada.194.origin from the libandroid_runtime.so system library. This module allows threat actors to potentially download further malicious components and ensure that such modules can interact effectively.

It is worth noting that the Trojan continues to evolve. Earlier this year, Triada used the open source sandbox DroidPlugin to boost its evasion abilities, SecurityWeek noted. However, in this latest development, Dr. Web researchers found the altered library on a range of Android devices, including Leagoo M5 Plus, Leagoo M8, Nomu S10 and Nomu S20.

How Should Users React?

It is impossible to delete the Android Trojan using traditional measures, such as antivirus and antimalware detection, because the malware is pre-installed and embedded into one of the libraries on the operating system. Dr. Web researchers suggested that the only safe and secure way to eradicate this Trojan is to run a clean installation of Android firmware. They informed the manufacturers of the compromised smartphones about the Triada Trojan so they can work toward a fix.

The presence of malicious software on new phones represents a fresh danger to users and businesses. Users are advised to look out for official updates and to run these releases as soon as they become available.

More from

How to craft a comprehensive data cleanliness policy

3 min read - Practicing good data hygiene is critical for today’s businesses. With everything from operational efficiency to cybersecurity readiness relying on the integrity of stored data, having confidence in your organization’s data cleanliness policy is essential.But what does this involve, and how can you ensure your data cleanliness policy checks the right boxes? Luckily, there are practical steps you can follow to ensure data accuracy while mitigating the security and compliance risks that come with poor data hygiene.Understanding the 6 dimensions of…

2024 roundup: Top data breach stories and industry trends

3 min read - With 2025 on the horizon, it’s important to reflect on the developments and various setbacks that happened in cybersecurity this past year. While there have been many improvements in security technologies and growing awareness of emerging cybersecurity threats, 2024 was also a hard reminder that the ongoing fight against cyber criminals is far from over.We've summarized this past year's top five data breach stories and industry trends, with key takeaways from each that organizations should note going into the following…

Black Friday chaos: The return of Gozi malware

4 min read - On November 29th, 2024, Black Friday, shoppers flooded online stores to grab the best deals of the year. But while consumers were busy filling their carts, cyber criminals were also seizing the opportunity to exploit the shopping frenzy. Our system detected a significant surge in Gozi malware activity, targeting financial institutions across North America. The Black Friday connection Black Friday creates an ideal environment for cyber criminals to thrive. The combination of skyrocketing transaction volumes, a surge in online activity…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today