{
  "family": "nemesis",
  "sample_count": 103,
  "category": "bootkit",
  "description": "Nemesis (extensively analyzed by Mandiant and FireEye research teams, with its primary bootkit component dubbed BOOTRASH) is an advanced, targeted malware ecosystem and sub-OS bootkit active since 2015. Developed and operated by the financially motivated threat actor group FIN1, Nemesis was engineered to compromise point-of-sale (POS) environments, payment card processing networks, and banking institutions to steal payment data and corporate credentials. What distinguishes Nemesis as an elite persistent threat is its integration of the BOOTRASH bootkit utility: BOOTRASH modifies the Windows Volume Boot Record (VBR) or Master Boot Record (MBR), allowing the malware to execute low-level code before the Windows operating system kernel boots. By executing in the pre-boot environment outside the standard file system, Nemesis completely bypasses operating system security controls, integrity verification, and endpoint detection and response (EDR) sensors. Even complete hard drive reformatting and operating system reinstallation fails to eradicate Nemesis if the underlying boot sectors are not sanitized. The post-boot user-mode components provide attackers with keylogging, screen capture, process injection, and persistent interactive backdoors.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BOOTRASH",
    "Nemesis Bootkit",
    "Backdoor:Win32/Nemesis",
    "Trojan.Nemesis",
    "FIN1 Nemesis Suite"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Nemesis / BOOTRASH malware suite?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nemesis is a sophisticated bootkit and backdoor ecosystem operated by FIN1 that executes pre-boot code via Volume Boot Record modifications."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor group is associated with Nemesis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mandiant attributed the Nemesis ecosystem to FIN1, a financially motivated cybercrime group targeting financial and payment processing systems."
      }
    },
    {
      "@type": "Question",
      "name": "Why is the BOOTRASH bootkit component exceptionally difficult to remediate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it resides in raw disk sectors outside the OS file system, persisting even after operating system reinstallation and standard formatting."
      }
    },
    {
      "@type": "Question",
      "name": "What industries were targeted by the Nemesis threat actor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FIN1 deployed Nemesis against retail point-of-sale systems, financial transaction processors, hospitality, and banking networks."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams detect and eradicate Nemesis infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform raw physical disk forensics to detect MBR/VBR modifications, enable UEFI Secure Boot, and conduct low-level physical drive wipes."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1542.003",
    "T1055",
    "T1056.001",
    "T1113",
    "T1105",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Pre-OS Boot: Bootkit",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate affected point-of-sale terminals and servers from corporate and payment processing networks.",
    "Perform raw physical disk analysis (e.g., using specialized forensic disk parsers) to inspect the Volume Boot Record (VBR) for unauthorized hooks.",
    "Do NOT rely on standard operating system reinstallation; execute a low-level cryptographic wipe of the physical disk drive before rebuilding.",
    "Enforce hardware-level UEFI Secure Boot with verified firmware integrity across all endpoints to prevent pre-boot sector execution."
  ],
  "what_to_avoid": [
    "Do not assume reformatting the OS partition cleans the threat, as BOOTRASH resides in reserved disk sectors outside the file system.",
    "Avoid relying solely on OS-level EDR tools during triage, as the pre-boot component can subvert operating system security hooks."
  ],
  "target_industries": [
    "Banking and Financial Services",
    "Payment Card Processors",
    "Retail and Hospitality POS"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "FIN1",
    "Financially Motivated Threat Syndicates"
  ],
  "target_geographies": [
    "North America",
    "Europe",
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe",
    "mbr_vbr"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "lineage": {
    "derived_from": [
      "Advanced Windows Bootkits",
      "FIN1 Custom Toolset"
    ],
    "variants": [
      "BOOTRASH VBR Hook",
      "Nemesis User-Mode RAT"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c",
      "0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d"
    ],
    "delivery": [
      "Targeted spearphishing emails directed at financial and retail administrators",
      "Lateral movement from compromised corporate network segments"
    ],
    "persistence": [
      "Volume Boot Record (VBR) pre-boot loader modification",
      "Master Boot Record (MBR) sector hooks"
    ]
  },
  "sources": [
    {
      "name": "Mandiant Threat Research - FIN1 Nemesis Bootkit Ecosystem",
      "url": "https://www.mandiant.com/resources/blog/nemesis-bootkit"
    },
    {
      "name": "The Hacker News - Nemesis Bootkit Infects Windows at Bootloader Level",
      "url": "https://thehackernews.com/2015/12/nemesis-bootkit-malware.html"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}