Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Android backdoor called Keenadu has been discovered embedded in the firmware of several tablet brands. It infects the libandroid_runtime.so library during firmware building, injecting itself into every app launched on the device. Keenadu provides attackers unrestricted control over victims' devices, primarily for ad fraud purposes. The investigation revealed connections between Keenadu and other major Android botnets like Triada, BADBOX, and Vo1d. The malware was found in system apps, Google Play apps, and modified versions of popular apps. Over 13,000 users worldwide have been affected, with Russia, Japan, Germany, Brazil and the Netherlands seeing the highest number of infections.

Keenadu is a newly discovered Android backdoor that compromises tablets by infecting the libandroid_runtime.so library during the firmware build process. This infection method ensures that the malicious code is injected into every application launched on the device, granting attackers persistent and unrestricted control. The primary motive appears to be ad fraud, leveraging infected devices to generate fraudulent ad revenue. Keenadu is linked to other prominent Android botnets such as Triada, BADBOX, and Vo1d, suggesting shared codebases or coordinated operations. The malware has been embedded in system-level applications, legitimate Google Play apps, and modified versions of popular apps, indicating a multi-vector infection strategy. Over 13,000 devices worldwide have been compromised, with notable infection clusters in Russia, Japan, Germany, Brazil, and the Netherlands. The infection at the firmware level represents a sophisticated supply chain attack, complicating detection and remediation efforts. Although no active exploits are currently reported, the threat leverages advanced persistence techniques and can evade traditional security controls. The malware's capabilities include code injection (T1059.004), credential dumping or input capture (T1056.001), and system firmware manipulation (T1542.003), highlighting its advanced operational tactics. This threat underscores the risks inherent in firmware supply chains and the challenges in securing Android devices against deeply embedded malware.

Detailed information about The tablet conqueror and the links between major Android botnets. Get real-time updates, technical details, and mitigation strategies

The tablet conqueror and the links between major Android botnets - Live Threat Intelligence - Threat Radar | OffSeq.com

The tablet conqueror and the links between major Android botnets

Threats Tagged 'keenadu'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'keenadu'

Lead Pen Test Professional