August 3, 2017 By Mark Samuels 2 min read

The Triada Trojan has been found in the firmware of various low-cost Android devices, which could be used to steal sensitive data and run cyber espionage modules.

The Trojan, called Android.Triada.231, was discovered by Dr. Web researchers. Entrenched in the source code of the libandroid_runtime.so system library, the malware infiltrates application processes, and can covertly download and run further malicious modules.

How Does the Triada Trojan Work?

Triada is an advanced form of malware that can insert itself into Zygote, which is an essential system component used to run programs, reported SecurityWeek. By infecting Zygote, the Trojan can launch malicious modules without the user’s knowledge.

Since it is embedded in the libandroid_runtime.so system library, the Triada Trojan is present in the memory of all running apps. This enables it to penetrate the processes of all apps without root privileges.

After the initialization process, Triada sets up some boundaries: The malware creates a working directory and checks the running environment. If the environment is suitable, it intercepts a system method, tracks the initialization of applications and performs malicious actions.

How Dangerous Is the Malware?

Dr. Web researchers reported that Triada can be used to surreptitiously download additional modules. These Trojans may run malicious plugins that allow cybercriminals to steal sensitive data from bank applications, initialize cyber espionage modules and interrupt social media conversations.

Triada can also be used to extract the encrypted module Android.Triada.194.origin from the libandroid_runtime.so system library. This module allows threat actors to potentially download further malicious components and ensure that such modules can interact effectively.

It is worth noting that the Trojan continues to evolve. Earlier this year, Triada used the open source sandbox DroidPlugin to boost its evasion abilities, SecurityWeek noted. However, in this latest development, Dr. Web researchers found the altered library on a range of Android devices, including Leagoo M5 Plus, Leagoo M8, Nomu S10 and Nomu S20.

How Should Users React?

It is impossible to delete the Android Trojan using traditional measures, such as antivirus and antimalware detection, because the malware is pre-installed and embedded into one of the libraries on the operating system. Dr. Web researchers suggested that the only safe and secure way to eradicate this Trojan is to run a clean installation of Android firmware. They informed the manufacturers of the compromised smartphones about the Triada Trojan so they can work toward a fix.

The presence of malicious software on new phones represents a fresh danger to users and businesses. Users are advised to look out for official updates and to run these releases as soon as they become available.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today