In a press release, Friday (04/02/2016), Kaspersky Lab said the Trojan was created by cyber criminals who were very professional and operated quietly.
Kaspersky Lab noted that almost half of the 20 top in 2015 Trojan were a malicious program that has the ability to gain super-user privileges. This capability provides flexibility to the cyber criminals to install the app on your device in which the users don't know it.
This type of malware is spread through the application downloaded from an untrusted source. These applications sometimes could be found on the official application store, Google Play, which is disguised as games or entertainment applications.
The application also can be installed when the update process of popular applications on the device, and sometimes when pre-installed on mobile devices. The most risk device is that using the Android OS 4.4.4. and earlier versions.
There were about 11 types of mobile Trojans are known to use root privileges. Three of them are Ztorg, Gorpo and Leech, which works mutually associated with one another.
"Trojan Triada either Ztrog, Gorpo and Leech marks a new evolution in threats based on Android. It is the first malware that spread widely and has the potential to improve their ability in most devices," said Nikita Buchka, Junior Malware Analyst, Kaspersky Lab.
"The majority of users were attacked by Trojan were located in Russia, India, Ukraine and the countries of Asia Pacific. We can not underestimate the threat of malicious applications that managed to get root access to the device," he continued.
The Trojan that was infected the devices usually organize themselves into networks, creating a kind of botnet form of advertisements so that the perpetrators of threats can use it to install various types of adware.
After rooting the device, the Trojan is downloaded and installed backdoor. Furthermore, the backdoor will download and activate two modules that have the ability to download, install and run the application.
App loader and its module installation along with customized according to the type of Trojan, but all of them have been listed in the Kaspersky Lab antivirus databases by name Triada.
"Its main threat to (Ztrog, Gorpo Leech), as shown by Triada, was the capable of providing access to malicious applications that are far more advanced and dangerous to the device," said Buchka."
They also have excellent architecture developed by cyber criminals with a thorough knowledge of a targeted attack against a mobile platform," he added.