Threat hunters at ESET are training the spotlight on a previously undocumented UEFI bootkit capable of hijacking the EFI System Partition (ESP) to maintain persistence on infected Windows machines.
The ESET discovery is the second real-world UEFI bootkit to be publicly documented in recent weeks, following Kaspersky’s report on a new Windows UEFI bootloader fitted into the FinSpy surveillance spyware product.
According to ESET researchers Anton Cherepanov and Martin Smolar, the malware has evaded detection for almost a decade and was engineered to bypass Windows Driver Signature Enforcement to load its own unsigned driver.
“We traced the roots of this threat back to at least 2012, previously operating as a bootkit for systems with legacy BIOSes,” the research team said, noting that the upgrade to UEFI went unnoticed and undocumented for many years. “The days of UEFI (Unified Extensible Firmware Interface) living in the shadows of the legacy BIOS are gone for good.”
ESET named the threat “ESPecter” and warned it is capable of injecting code to set up command-and-control server connections.
[ READ: FinSpy Surveillance Spyware Fitted With UEFI Bootkit ]
ESET, which sells anti-malware software to corporate customers around the world, said the bootkit was spotted on a compromised machine along with a user-mode client component with keylogging and document-stealing functionalities
From the ESET report:
By patching the Windows Boot Manager, attackers achieve execution in the early stages of the system boot process, before the operating system is fully loaded. This allows ESPecter to bypass Windows Driver Signature Enforcement (DSE) in order to execute its own unsigned driver at system startup.
This driver then injects other user-mode components into specific system processes to initiate communication with ESPecter’s C&C server and to allow the attacker to take control of the compromised machine by downloading and running additional malware or executing C&C commands.
The researchers say they were not able to attribute ESPecter to any known threat actor, but noted there were signs of Chinese debug messages in the user-mode client component, a suggestion that an unknown Chinese-speaking threat actor may be behind this campaign.
“After all the years of insignificant changes, those behind ESPecter apparently decided to move their malware from legacy BIOS systems to modern UEFI systems. They decided to achieve this by modifying a legitimate Windows Boot Manager binary (bootmgfw.efi) located on the ESP while supporting multiple Windows versions spanning Windows 7 through Windows 10,” the team said.
[ READ: Russian Cyberspies Use UEFI Rootkit in Attacks ]
The persistence method only works if the Secure Boot feature in Windows is disabled, a reality on older versions of Microsoft’s operating system.
For Windows OS versions that support Secure Boot, ESET said the attacker could disable the feature via an “evil maid” physical access attack or exploiting additional security vulnerabilities to expand the attack.
“ESPecter shows that threat actors are relying not only on UEFI firmware implants when it comes to pre-OS persistence and, despite the existing security mechanisms like UEFI Secure Boot, invest their time into creating malware that would be easily blocked by such mechanisms, if enabled and configured correctly,” the researchers said.
Related: FinSpy Surveillance Spyware Fitted With UEFI Bootkit
Related: China-Linked Hackers Used UEFI Malware in Attacks
Related: Meet MBR-ONI, Bootkit Ransomware Used as a Targeted Wiper
Related: Russian Hackers Using Bootkit to Steal Payment Data

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Anti-Bot Software Firm DataDome Banks $42M Financing
- Malware Hunters Spot Supply Chain Attack Hitting 3CX Desktop App
- LeapXpert Banks $22M Funding to Secure Corporate Messaging With Consumer Apps
- Spera Banks $10 Million to Tackle Identity and Access Sprawl
- Mandiant Catches Another North Korean Gov Hacker Group
- Microsoft Puts ChatGPT to Work on Automating Cybersecurity
- Microsoft: No-Interaction Outlook Zero Day Exploited Since Last April
- Tesla Hacked Twice at Pwn2Own Exploit Contest
Latest News
- Anti-Bot Software Firm DataDome Banks $42M Financing
- Unpatched Security Flaws Expose Water Pump Controllers to Remote Hacker Attacks
- 500k Impacted by Data Breach at Debt Buyer NCB
- Chinese Cyberspies Use ‘Melofee’ Linux Malware for Stealthy Attacks
- Why Endpoint Resilience Matters
- Microsoft Cloud Vulnerability Led to Bing Search Hijacking, Exposure of Office 365 Data
- 3CX Confirms Supply Chain Attack as Researchers Uncover Mac Component
- UK Introduces Mass Surveillance With Online Safety Bill
