MoonBounce
UEFI malware
From Wikipedia, the free encyclopedia
MoonBounce is a UEFI firmware-based rootkit. It is linked to the Chinese APT41 hacker group. MoonBounce was discovered by the researchers at Kaspersky in 2021.[1] It can disable Windows security tools and bypass User Account Control.[2]
| MoonBounce | |
|---|---|
| Malware details | |
| Type | Bootkit |
| Classification | Rootkit |
| Author | APT41 |
| Technical details | |
| Platform | Microsoft Windows |
Data shows that the attacks are highly targeted.[3] The malware is a landmark in UEFI rootkit evolution.[4] It is the third known malware UEFI bootkit found.[citation needed]
Infection
Kaspersky has detected the firmware rootkit in only one case so little was discovered in regards to the way the rootkit is supposed to spread. It is believed that it had been installed remotely.[5]
The SPI flash memory on the motherboard is the implanting location. CORE_DXE is the firmware laced component which is used during the first phases of the UEFI boot sequence. It hooks EFI Boot Services functions and inject more malware into a svchost.exe process during boot.[6]
It resides on a low level portion of the hard drive. It operates in memory only which makes it undetectable on the HDD.[7]