chinese espionage deploys new rootkit compatible

#Chinese espionage deploys new rootkit compatible drivers#
#Chinese espionage deploys new rootkit compatible driver#

This means the UEFI firmware of a computer from one vendor will be slightly different then the UEFI firmware from a computer from another manufacturer. However, while UEFI is a standard, PC manufacturers maintain their own implementations customized for their devices.

#Chinese espionage deploys new rootkit compatible drivers#

Also, the operating system’s security features such as digital signature verification for drivers has not yet been initialized and can be disabled or bypassed. Getting malicious code to execute into such an early initialization phase of a device is extremely powerful because there is no antivirus or intrusion detection solution that runs at that level. The UEFI contains various drivers that are used to talk to the other chips on the motherboard as well as the CPU and other peripherals. The firmware is stored on a memory chip called the SPI flash that’s soldered on the motherboard and contains the code necessary to initialize all the other hardware components and configure them before execution is passed to the bootloader code that starts the main operating system and its kernel. In fact, the terms are still used interchangeably in many cases since most modern BIOSes follow the UEFI standard and specification. The Unified Extensible Firmware Interface (UEFI) is the modern replacement for the BIOS. They are typically found in the arsenal of well-resourced and sophisticated attacker groups. While MoonBounce is not the first UEFI rootkit found in the wild - LoJax, MosaicRegressor are two examples– these types of implants are not common because they require knowledge of low-level firmware programming.

#Chinese espionage deploys new rootkit compatible driver#

Dubbed MoonBounce by researchers from Kaspersky Lab, the implant’s goal is to inject a malicious driver into the Windows kernel during the booting stages, providing attackers with a high level of persistence and stealthiness. The group is known for using software supply-chain attacks in the past. Researchers uncovered a stealthy UEFI rootkit that’s being used in highly targeted campaigns by a notorious Chinese cyberespionage group with suspected government ties.