Nemesis

Overview

Nemesis (extensively analyzed by Mandiant and FireEye research teams, with its primary bootkit component dubbed BOOTRASH) is an advanced, targeted malware ecosystem and sub-OS bootkit active since 2015. Developed and operated by the financially motivated threat actor group FIN1, Nemesis was engineered to compromise point-of-sale (POS) environments, payment card processing networks, and banking institutions to steal payment data and corporate credentials. What distinguishes Nemesis as an elite persistent threat is its integration of the BOOTRASH bootkit utility: BOOTRASH modifies the Windows Volume Boot Record (VBR) or Master Boot Record (MBR), allowing the malware to execute low-level code before the Windows operating system kernel boots. By executing in the pre-boot environment outside the standard file system, Nemesis completely bypasses operating system security controls, integrity verification, and endpoint detection and response (EDR) sensors. Even complete hard drive reformatting and operating system reinstallation fails to eradicate Nemesis if the underlying boot sectors are not sanitized. The post-boot user-mode components provide attackers with keylogging, screen capture, process injection, and persistent interactive backdoors.

Known aliases

Threat reports may refer to this family under multiple names:

• BOOTRASH
• Nemesis Bootkit
• Backdoor:Win32/Nemesis
• Trojan.Nemesis
• FIN1 Nemesis Suite

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Advanced Windows Bootkits · Fin1 Custom Toolset

Known Derivatives & Downstream Variants: Bootrash Vbr Hook · Nemesis User-Mode Rat

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1113: Monitor for frequent or unauthorized screen captures or clipboard reads. Restrict background applications from accessing desktop APIs.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c
• 0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d

Delivery vectors

• Targeted spearphishing emails directed at financial and retail administrators
• Lateral movement from compromised corporate network segments

Persistence mechanisms

• Volume Boot Record (VBR) pre-boot loader modification
• Master Boot Record (MBR) sector hooks

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_NEMESIS_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Nemesis"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "nemesis" ascii wide nocase
        $s2 = "bootrash" ascii wide nocase
        $s3 = "nemesis bootkit" ascii wide nocase
        $s4 = "backdoor:win32/nemesis" ascii wide nocase
        $s5 = "trojan.nemesis" ascii wide nocase
        $s6 = "fin1 nemesis suite" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Nemesis (Bootkit) Execution & Triage
id: df5f1e56-0555-522d-adc1-7896f168ad0e
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Nemesis malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/nemesis
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.bootkit
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1542_003
- attack.t1055
- attack.t1056_001
- attack.t1113
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_NEMESIS_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Nemesis tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "nemesis" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate affected point-of-sale terminals and servers from corporate and payment processing networks.
2. Perform raw physical disk analysis (e.g., using specialized forensic disk parsers) to inspect the Volume Boot Record (VBR) for unauthorized hooks.
3. Do NOT rely on standard operating system reinstallation; execute a low-level cryptographic wipe of the physical disk drive before rebuilding.
4. Enforce hardware-level UEFI Secure Boot with verified firmware integrity across all endpoints to prevent pre-boot sector execution.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume reformatting the OS partition cleans the threat, as BOOTRASH resides in reserved disk sectors outside the file system.
2. Avoid relying solely on OS-level EDR tools during triage, as the pre-boot component can subvert operating system security hooks.

References & External Analysis

• Mandiant Threat Research - FIN1 Nemesis Bootkit Ecosystem
• The Hacker News - Nemesis Bootkit Infects Windows at Bootloader Level
• Search "nemesis" on VirusTotal (External Analysis)
• Search "nemesis" on Any.Run (Sandbox Sandbox)
• Search "nemesis" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Bootkit)

Explore other documented threats in the same operational category:

• Rovnix

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/nemesis.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.