Operation NoVoice: Silent Persistence and the Rootkit Lifecycle
Operation NoVoice: The Android Rootkit That Survives a Factory Reset NoVoice is a mobile-espionage campaign that hid in 50+ Google Play apps (2.3M+ downloads), chained 22 legacy Android exploits to gain root, and planted a Zygote-level rootkit that hooks the…
- Rootkit
- Android
Bottom line. Old, unpatched Android is the entire attack surface here: every exploit NoVoice uses was fixed by the 2021-05-01 patch level, so devices at or above it are not vulnerable. For fleets, the priority is retiring or isolating Android 7-and-lower devices; for confirmed infections, a userland clean-up is not enough – the rootkit lives on the system partition and requires a verified firmware reflash.
Background
Operation NoVoice (documented publicly by McAfee) distributed malware through more than 50 Google Play apps disguised as cleaners, games and utilities, accumulating over 2.3 million downloads. The apps behaved as advertised, giving no obvious sign of compromise.
The campaign weaponizes an arsenal of 22 exploits for Android vulnerabilities patched between 2016 and 2021, deliberately targeting older, end-of-life devices (Android 7 and below). All devices at security patch level 2021-05-01 or higher are outside the exploitable range.
The campaign name comes from a plugin that embeds a silent audio resource, R.raw.novioce (believed to be a typo for ‘no voice’). Playing this zero-volume clip continuously keeps a background service alive by abusing Android’s media-playback exemptions – the malware stays resident without drawing attention. McAfee notes heavy functional overlap with the Triada family, suggesting shared tooling or ancestry.
What we observed
The attack chain is modular and staged, assembling itself from C2 rather than shipping a full payload in the app:
- Staged bootstrap: malicious code is injected into a legitimate Facebook SDK initialization sequence and hides an encrypted payload appended after the PNG IEND marker (a polyglot image). It profiles the device (30+ identifiers, root status) and pulls device-tailored exploits from C2 (config.googleslb.com), focusing on IPv6-handling and Mali GPU driver bugs.
- Root and Zygote persistence: after a kernel exploit succeeds it strips SELinux and drops a native rootkit (tracked as CsKaitno.d), replacing core libraries /system/lib*/libandroid_runtime.so and /system/lib*/libmedia_jni.so so every app spawned by Zygote inherits attacker code at startup; a jkpatch component rewrites framework bytecode on disk.
- Self-healing and firmware persistence: a watchdog re-checks the hooks roughly every 60 seconds and restores them (forcing a reboot) if removed, while fallback payloads on the system partition survive factory resets.
- IPC and data theft: a Binder-based AKServer (in system_server) / AKClient (injected into apps like Chrome, WhatsApp, YouTube) architecture loads arbitrary DEX at runtime; when WhatsApp launches, the malware extracts the encryption databases, Signal-protocol keys, phone number and Google Drive backup details needed to clone the session.
- Anti-analysis and geofencing: 15 checks screen for emulators, debuggers and analysis VPNs, and deployment halts for devices physically located in Beijing and Shenzhen.
NoVoice infection chain
Old, unpatched Android is the whole story – patch level 2021-05-01+ blocks every exploit in the chain.
Attribution
McAfee reports strong functional and structural overlap with historical Triada variants – shared persistence loops and identical system-property markers – suggesting common developer tooling or direct lineage rather than a distinct new actor. The exclusion of devices in Beijing and Shenzhen is an operational observation, not a firm attribution. Treat operator identity as unconfirmed and rely on primary reporting and telemetry.
Confidence: 90%.
A rootkit that lives on the system partition doesn’t fear a factory reset – the only honest fix is a verified firmware reflash.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Initial Access | Masquerading (Mobile) | T1655 | 50+ Google Play apps posed as cleaners, games and utilities to gain installs. |
| Execution | Download New Code at Runtime (Mobile) | T1407 | Fetches plugins, device-tailored exploits and DEX payloads from C2 rather than shipping them in the app. |
| Privilege Escalation | Exploitation for Privilege Escalation (Mobile) | T1404 | Chains 22 legacy CVEs (2016-2021), including IPv6 and Mali GPU driver bugs, to reach root. |
| Defense Evasion | Virtualization/Sandbox Evasion: System Checks (Mobile) | T1633.001 | Runs 15 checks for emulators, debuggers and analysis VPNs, and geofences out Beijing/Shenzhen. |
| Defense Evasion | Hooking (Mobile) | T1617 | Replaces libandroid_runtime.so / libmedia_jni.so so Zygote injects attacker code into every app. |
| Persistence | Modify System Partition (Mobile) | T1400 | Stores rootkit and fallback payloads on the system partition, surviving factory resets. |
| Collection | Access Stored Application Data (Mobile) | T1409 | Extracts WhatsApp encryption databases, Signal-protocol keys and account identifiers to clone the session. |
| Command and Control | Application Layer Protocol: Web Protocols (Mobile) | T1437.001 | Beacons device profiles and receives payloads over web protocols to C2 (config.googleslb.com). |
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
config[.]googleslb[.]com | domain | Command-and-control / exploit-delivery server |
Detection
Copy-ready hunting query:
# Network: beacons to the NoVoice C2 / exploit-delivery domain
index=dns OR index=proxy
| search domain="config.googleslb.com" OR query="config.googleslb.com"
| stats count values(src_ip) as devices by domain
# On-device / firmware integrity (MDM, EDR-mobile, or offline image analysis):
# 1) Verify system libraries against known-good baselines
# /system/lib*/libandroid_runtime.so and /system/lib*/libmedia_jni.so
# (check for unauthorized hooks, e.g. inside println_native)
# 2) Modified framework bytecode on disk:
# /data/dalvik-cache/arm*/system@framework@*[email protected]
# 3) Logcat / crash streams bearing the tag: AK_CPP
# 4) APK assets: PNG files with an encrypted payload appended after the IEND marker
# 5) Artifact/component names: CsKaitno.d, jkpatch, security.jar, R.raw.novioce
# Fleet posture: flag devices below security patch level 2021-05-01 (all exploits pre-date it)Recommendations
- Retire, upgrade or network-isolate Android 7-and-lower devices; enforce a minimum security patch level of 2021-05-01, below which every NoVoice exploit is viable.
- For confirmed infections, do not rely on factory reset or userland AV – the rootkit persists on the system partition; require a verified OEM firmware reflash and re-provision from trusted images.
- Block and hunt C2 domain config.googleslb.com, and validate integrity of libandroid_runtime.so / libmedia_jni.so and framework dalvik-cache against known-good baselines via offline/out-of-band analysis.
- Because WhatsApp session data (encryption DBs, Signal keys, Google Drive backup details) may be stolen, treat affected accounts as compromised – re-register the app, revoke linked sessions and rotate associated credentials.
