Bootkits & Firmware Threats

Threat Class: Master Boot Record / UEFI Firmware Threat Tracked Families: 2 Severity: CRITICAL MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Bootkits represent an escalation of rootkit tradecraft, compromising code execution before the operating system kernel even initializes. By subverting the Master Boot Record (MBR), Volume Boot Record (VBR), or modern UEFI firmware/NVRAM, bootkits gain absolute persistence that survives operating system re-installations and drive formatting. Bootkits disable kernel-mode code signing, patch the Windows boot manager (bootmgr), and install stealth hypervisors to inspect and modify all subsequent OS execution.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Rootkit & Bootkit Protection

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID Technique Tactic Observed Operational Behavior
T1542.003 Bootkit Persistence Overwrites the MBR/VBR or UEFI NVRAM to execute malicious code prior to OS initialization.
T1542.001 System Firmware Persistence Modifies motherboard BIOS/UEFI firmware code for permanent hardware-level survival.
T1562.001 Impair Defenses Defense Evasion Disables Windows Secure Boot, BitLocker measurement, and TPM attestation.
T1014 Rootkit Defense Evasion Intercepts kernel loading routines to inject Ring-0 implants on every system boot.
T1068 Exploitation for Privilege Escalation Privilege Escalation Gains highest possible hardware privileges (Ring -1 / SMM).

Actively Weaponized Exploits & Vulnerabilities

While primary payloads in bootkits & firmware threats predominantly leverage social engineering, phishing attachments, or credential reuse, see our authoritative CVE Exploitation Matrix for software vulnerabilities weaponized across cataloged threat campaigns.

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

  1. Verify hardware UEFI Secure Boot status and inspect TPM platform configuration registers (PCRs).
  2. Perform low-level disk analysis from an external diagnostic system to check for MBR/VBR modifications.
  3. Update motherboard firmware directly from vendor-signed offline media; perform a complete CMOS/NVRAM reset.
  4. Re-partition drives using clean GUID Partition Tables (GPT) and reinstall operating systems from trusted media.
  5. Deploy hardware-enforced measured boot and remote device attestation.
⚠️ Critical Mistakes to Avoid:
  • Do not simply format disk partitions; UEFI/NVRAM bootkits reside entirely within motherboard flash memory.
  • Do not bypass hardware Secure Boot prompts.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

nemesis

EMBER Samples: 103

Nemesis (extensively analyzed by Mandiant and FireEye research teams, with its primary bootkit component dubbed BOOTRASH) is an advanced,...

View Profile & Rules →

rovnix

EMBER Samples: 5

Trojan:Win32/Rovnix is a highly sophisticated bootkit and trojan downloader designed to infect the Master Boot Record (MBR) or Volume Boo...

View Profile & Rules →

Complete Directory (2 Families)

Alphabetical index of all tracked malware families cataloged under bootkits & firmware threats: