The security assumption that a new, unopened device is a clean device has been a reasonable baseline for most organizations managing mobile fleets. Kaspersky research has identified a threat that undermines that assumption at its foundation. The Keenadu backdoor malware is being found preinstalled on Android devices, in some cases deployed at the firmware level before devices leave the manufacturing and distribution chain. Kaspersky has confirmed 13,000 infected endpoints across multiple countries, with concentrations in Japan, Germany, Russia, Brazil, and the Netherlands. The threat is not theoretical, and the infection vector, the supply chain itself, is one that most organizational security programs are not structured to defend against. Understanding what firmware-level malware can do, why it evades conventional detection, and what organizations can do to reduce their exposure is the practical starting point for IT teams reassessing their device procurement and management approach in light of this research.
What Makes Firmware-Level Infection Categorically Different From Standard Malware
Most malware that reaches Android devices arrives through the operating system layer, delivered via malicious applications, compromised downloads, or phishing attacks that execute code within the OS environment. Security tools, antivirus software, endpoint protection platforms, and mobile device management systems are designed to detect and respond to threats operating at this layer. They are effective against the threats they were built to address.
Firmware-level malware operates below the OS layer, in the foundational code that initializes hardware and loads the operating system itself. This architectural position gives it capabilities and persistence characteristics that OS-layer malware cannot match. Conventional antivirus and endpoint security tools scan the OS environment and the applications running within it. They do not have visibility into the firmware layer where Keenadu is installed, which means the malware is effectively invisible to the security stack that most organizations rely on to detect and respond to threats on managed devices.
The persistence characteristics that follow from firmware-level installation are what make this threat particularly serious for organizations that discover an infection after the fact. Standard remediation approaches for compromised devices, factory reset, OS reinstallation, or hard drive replacement, operate at or above the firmware layer and do not affect malware installed below it. A device that appears to have been fully wiped and restored may still be running compromised firmware, making it unsafe to return to service after what would normally be considered a complete remediation.
Root-level access or better is what firmware compromise provides to attackers. In practice, this means complete control over every application installed on the device, the ability to install additional applications from APK files without user awareness, and the ability to unlock permissions that would normally require explicit user consent. Every category of sensitive information on the device- messages, media, banking credentials, authentication tokens, business application data- becomes accessible. For a device used in a business context with access to corporate systems, the exposure extends beyond the device itself to every system the device is authorized to access.
Identifying Infected Devices and Understanding the Scope of the Current Threat
Kaspersky has notified the affected vendors and the investigation is ongoing, but organizations should not wait for vendor-level resolution before assessing their own exposure. The behavioral indicators that Keenadu infection can produce are observable through normal device monitoring, though their presence is not conclusive and their absence does not confirm a clean device given the malware’s design to operate without drawing attention.
Unexplained application crashes or performance degradation inconsistent with normal usage patterns, increased data consumption without identifiable cause, unfamiliar applications appearing without authorized installation, abnormal battery drain during normal use, suspicious network connections to unrecognized servers, and unexpected restrictions on settings or application access are all potential indicators. None of these symptoms individually confirms infection, and a device exhibiting none of them may still be infected. The value of monitoring for these indicators is that they can prompt investigation rather than that their presence or absence is definitive.
The geographic distribution of confirmed infections- Japan, Germany, Russia, Brazil, and the Netherlands- does not define the boundaries of organizational risk. The supply chains for consumer electronics are global, and devices sold in markets outside the confirmed infection zones may have passed through affected distribution channels. The malware’s behavior of checking device language and time zone settings and not activating on devices associated with China is useful context for understanding the likely origin of the threat actors but does not provide meaningful protection for organizations in other markets.
The practical implication for organizations with Android device fleets is that procurement source matters in a way that was not previously a primary security consideration. Purchasing through manufacturer-approved channels and authorized distributors reduces, though does not eliminate, exposure to supply chain compromise compared to purchasing through gray market sources or unauthorized resellers where the chain of custody is less controlled.
What Organizations Should Do Now
Kaspersky’s recommendation for organizations that believe they may have infected devices is to deactivate all system apps and avoid using the devices for sensitive operations until clean firmware patches are available from the affected vendors. This is a significant operational imposition, but it reflects the severity of the access that firmware-level compromise provides. A device running Keenadu that is used for business operations, accessing corporate email, authenticating to business systems, or handling sensitive customer information, is providing that access to the attackers who control the malware.
For devices where infection is confirmed or strongly suspected, the standard remediation approaches are insufficient. Firmware replacement, where available from the manufacturer, is the remediation that addresses the actual infection layer. Organizations that do not have a clear path to verified clean firmware for affected devices should treat those devices as unrecoverable for business use rather than attempting OS-level remediation that leaves the firmware layer unaddressed.
The broader fleet management response involves several parallel workstreams. Auditing current Android device inventory for the behavioral indicators of infection, verifying procurement sources for devices currently in service, and establishing procurement standards that prioritize authorized channels going forward are the immediate organizational steps. Reviewing what business systems and data affected devices have had access to is necessary for assessing the potential scope of credential and data exposure if infected devices are identified, because the access that Keenadu provides means that any business system authenticated through an infected device should be treated as potentially compromised.
Mobile device management configuration that limits what data and systems Android devices can access provides some containment of the exposure that a compromised device creates, even when the compromise itself cannot be detected through the MDM platform. Devices that are restricted to the minimum access required for their business function limit the blast radius of a compromise relative to devices with broad system access. This principle of least-privilege access applies to mobile devices in the same way it applies to other endpoints, and the Keenadu findings provide a concrete illustration of why it matters.
Regular firmware and OS updates from verified sources remain relevant defensive practices even against a threat that originates in the supply chain, because updates from legitimate manufacturers can address vulnerabilities that threat actors exploit in the distribution chain and provide the clean firmware versions that remediate known infections. The emphasis on verified sources is not incidental: an update process that installs firmware from unverified sources could introduce the same category of threat that legitimate updates are intended to address. Maintaining a clear process for firmware update verification is the organizational control that ensures the update process itself does not become an attack vector.
