The Triada Trojan has been found in the firmware of various low-cost Android devices, which could be used to steal sensitive data and run cyber espionage modules.

The Trojan, called Android.Triada.231, was discovered by Dr. Web researchers. Entrenched in the source code of the libandroid_runtime.so system library, the malware infiltrates application processes, and can covertly download and run further malicious modules.

How Does the Triada Trojan Work?

Triada is an advanced form of malware that can insert itself into Zygote, which is an essential system component used to run programs, reported SecurityWeek. By infecting Zygote, the Trojan can launch malicious modules without the user’s knowledge.

Since it is embedded in the libandroid_runtime.so system library, the Triada Trojan is present in the memory of all running apps. This enables it to penetrate the processes of all apps without root privileges.

After the initialization process, Triada sets up some boundaries: The malware creates a working directory and checks the running environment. If the environment is suitable, it intercepts a system method, tracks the initialization of applications and performs malicious actions.

How Dangerous Is the Malware?

Dr. Web researchers reported that Triada can be used to surreptitiously download additional modules. These Trojans may run malicious plugins that allow cybercriminals to steal sensitive data from bank applications, initialize cyber espionage modules and interrupt social media conversations.

Triada can also be used to extract the encrypted module Android.Triada.194.origin from the libandroid_runtime.so system library. This module allows threat actors to potentially download further malicious components and ensure that such modules can interact effectively.

It is worth noting that the Trojan continues to evolve. Earlier this year, Triada used the open source sandbox DroidPlugin to boost its evasion abilities, SecurityWeek noted. However, in this latest development, Dr. Web researchers found the altered library on a range of Android devices, including Leagoo M5 Plus, Leagoo M8, Nomu S10 and Nomu S20.

How Should Users React?

It is impossible to delete the Android Trojan using traditional measures, such as antivirus and antimalware detection, because the malware is pre-installed and embedded into one of the libraries on the operating system. Dr. Web researchers suggested that the only safe and secure way to eradicate this Trojan is to run a clean installation of Android firmware. They informed the manufacturers of the compromised smartphones about the Triada Trojan so they can work toward a fix.

The presence of malicious software on new phones represents a fresh danger to users and businesses. Users are advised to look out for official updates and to run these releases as soon as they become available.

More from

More School Closings Coast-to-Coast Due to Ransomware

Instead of snow days, students now get cyber days off. Cyberattacks are affecting school districts of all sizes from coast-to-coast. Some schools even completely shut down due to the attacks. The federal government recently warned that K-12 schools face a growing threat from cyber groups. According to the FBI, school districts often have limited cybersecurity protections, which makes them even more vulnerable. The FBI also says it anticipates the number of threats to increase. In a recent warning, the nation’s…

The Role of Human Resources in Cybersecurity

The human resources (HR) department is an integral part of an organization. They work with all departments with a wider reach than even IT. As a highly visible department, HR can support and improve an organization’s security posture through employee training. Their access to employees at the start of employment is an opportunity to lay a foundation for a culture of risk awareness. HR departments do not typically include cybersecurity risk awareness training with new hire onboarding, but it’s something…

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…