Cybercriminals are constantly on the lookout for new ways to gain a long-term foothold in the target system with maximum privileges, while avoiding detection, for example, by antivirus tools. Most protection tools are started together with the operating system, so if malware loads before the OS does, the likelihood of detection decreases. Another goal of malware developers is to retain control and privileges after OS reinstallation. This requires the malware to be loaded into low-level software—the device firmware or the first sectors of the hard drive. That is how bootkits appeared.

Real or conceptual?

Bootkits were previously thought to exist mainly in proof-of-concept A proof of concept (PoC) is a demonstration of the exploitability of a vulnerability. form, and not used in real attacks. However, only two years separated the appearance of the first PoC and the first bootkit attack.

Malware developers are now adding bootkit functionality to their creations, including Satana, Petya, and various botnets, such as TrickBot. APT groups are also active users of bootkits, for example, Careto, Winnti (APT41), FIN1, and APT28.

Cybercriminals generally use targeted phishing via email to inject malware into the infrastructure; this is how, for instance, the Mebromi and Mosaic Regressor bootkits are distributed. Another delivery route is through websites, including the drive-by compromise technique, which was used to infect targets with the Pitou and Mebroot malware; cybercriminals distributing the latter hacked into more than 1,500 web resources and placed the malware there. The FispBoot bootkit got onto devices that were first infected with the Trojan-Downloader.NSIS.Agent.jd trojan, which victims downloaded under the guise of a video clip.

The difference between a bootkit and a rootkit

Bootkits are often confused with rootkits A rootkit is a program (set of programs) for concealing the presence of malware in the system. . The main difference is that bootkits start operating even before the OS boots. They have the same level of control as legitimate loaders (Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI) and interfere with the OS boot process, allowing them to monitor and alter the boot process, as well as introduce, for example, malicious code, bypassing security mechanisms. Bootkits often create the environment for the stealthy introduction of kernel-level rootkits.

Bootkit features

Most often, bootkits have the following features:

• Covert installation of the main payload, such as a rootkit or a backdoor in user mode;
• Covert malicious activity, bypassing or even disabling protection tools;
• Downloading of additional malware;
• Escalation of system privileges.

Some bootkits allow attackers to bypass authentication; the PoCs of the Vbootkit x64 and DreamBoot bootkits, for example, have this capability.

Bootkits as tools for highly targeted attacks

Developing one's own bootkit is no trivial task for an attacker, but in real life bootkits are quite common. For example, attackers spying on diplomats and members of non-governmental organizations from Africa, Asia, and Europe used the Mosaic Regressor bootkit to gain a foothold in the target systems. Having analyzed an attack using another state-of-the-art bootkit, MoonBounce, researchers were amazed at the attackers' deep knowledge of the victim's IT infrastructure. They saw that the attackers had thoroughly studied the device firmware, which suggests that this was a highly targeted attack.

However, cybercriminals use bootkits not only in targeted attacks, but also in mass ones. For example, the Rovnix bootkit was distributed as part of a phishing campaign using information about a new World Bank coronavirus initiative as bait. The purpose of the campaign seems to have been cyberespionage, since malware for remote control and spyware were subsequently installed on victims' devices. The Adushka bootkit is known for targeting regular users and being used for espionage, including data theft from online gaming accounts.

Another bootkit deployed in mass attacks is Oldboot. Its focus was Android devices. The attackers infected more than 350,000 mobile devices. Malicious code added to the boot partition of the file system was launched when the device was switched on for the first time. The bootkit created the environment for the introduction of a loader and spyware that collected and deleted text messages. To avoid infection, researchers advise against purchasing devices from untrusted stores and downloading firmware from dubious sources.

Now bootkits are becoming increasingly common in the toolkit of attackers. And the regular discovery of vulnerabilities in firmware is contributing to this trend. For UEFI, for example, 14 entries appeared in the National Vulnerability Database (NVD) in 2021 alone. The liveness of bootkits is underscored too by the emergence of new functionality for commercial malware: in 2021, the developers of the FinSpy spyware upgraded their creation with bootkit features.

Bootkit detection and removal

Bootkit detection is feasible if done before it becomes embedded in the firmware or the first partitions of the hard drive. Ascertaining whether a system is infected with a bootkit is not easy; even if possible, the victim will face even greater difficulties removing it. If the bootkit was introduced into the first partitions of the hard disk (MBR, VBR, or, in the case of a UEFI-based device, EFI System Partition), a complete reinstallation of the OS will remove the malicious code from the drive. However, any reinstallation of the OS will not affect the chip memory where the BIOS or UEFI firmware resides, so if the firmware is changed, the new OS may still be infected.

You can also determine which particular bootkit infected the system, and check for utilities from antivirus vendors for cleaning the system of malicious code.