Loading malware…
Bootkitty is a Linux-targeting UEFI bootkit and the first publicly described example of this class aimed at Linux systems, particularly several Ubuntu versions. It operates in the pre-OS boot chain as a malicious UEFI application and is designed to interfere with Linux boot integrity controls before the kernel starts. Reported behaviors include disabling Linux kernel signature verification, patching integrity-checking functions in memory, replacing the boot loader, patching the kernel prior to execution, and preloading additional ELF payloads through the Linux init process to give an attacker control very early in startup.
Bootkitty has been assessed as a proof of concept rather than a mature operational tool. Researchers reported development artifacts, limited platform compatibility, and no confirmed in-the-wild deployment at the time of analysis. The observed sample was self-signed, which means it cannot execute on systems where UEFI Secure Boot is properly enforced through trusted signing. Some reporting also associates Bootkitty with exploitation paths involving Secure Boot bypasses and firmware weaknesses such as LogoFAIL, but the highest-confidence characterization is that Bootkitty is a Linux UEFI bootkit whose purpose is to subvert the boot chain and kernel trust model.
The malware has also been tracked under the name IranuKit. Its significance lies less in demonstrated widespread use than in showing that UEFI bootkit tradecraft is no longer confined to Windows-focused threats such as BlackLotus. Bootkitty illustrates how attackers or researchers can target Linux systems at firmware and boot level to achieve stealthy pre-OS execution and potentially persistent compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Two CVE IDs, CVE-2026-8863 and CVE-2026-10797, cover the reported shims, and Microsoft revoked the vulnerable binaries in the dbx update shipped with its June 9 Patch Tuesday.
Two CVE IDs, CVE-2026-8863 and CVE-2026-10797, cover the reported shims, and Microsoft revoked the vulnerable binaries in the dbx update shipped with its June 9 Patch Tuesday.
Через такой вектор можно развернуть полноценные UEFI-буткиты - BlackLotus или Bootkitty - даже при включённом Secure Boot. | CVE-2024-7344, обнаруженная исследователем ESET Martin Smolár, затрагивает UEFI-приложение Reloader - компонент нескольких утилит восстановления: Howyar SysReturn, Greenware GreenGuard, Radix SmartRecovery, Sanfong EZ-back System, CES NeoImpact. По данным ESET, также затронуты WASAY eRecoveryRX и SignalComputer HDD King.
This new threat exploits the LogoFAIL vulnerability (CVE-2023-40238), a UEFI firmware flaw, to bypass Secure Boot protections and inject malicious payloads. | Security researchers from Binarly and ESET have uncovered “Bootkitty,” the first-ever UEFI bootkit designed to target Linux systems. This new threat exploits the LogoFAIL vulnerability (CVE-2023-40238), a UEFI firmware flaw, to bypass Secure Boot protections and inject malicious payloads.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications could be abused to bypass Secure Boot on most systems using the modern firmware standard.
Attackers could bypass UEFI Secure Boot on a wide range of systems thanks to 11 Microsoft-signed UEFI shim bootloaders carrying vulnerabilities that have remained buried for more than a decade... Exploitation allows untrusted code to run during boot, opening the door to UEFI bootkits ... even with Secure Boot switched on.
Exploitation allows untrusted code to run during boot, opening the door to UEFI bootkits such as Bootkitty, HybridPetya and BlackLotus, even with Secure Boot switched on.
It’ll then try to preload two unknown executables during the system startup process.
This rogue MokList enables the bootkit to be trusted by the system’s Secure Boot components, allowing it to load during the early boot process.
The bootkit’s main goal is to disable the kernel’s signature verification feature... Another way to tell whether the bootkit is present on the system with UEFI Secure Boot enabled is by attempting to load an unsigned dummy kernel module during runtime. If it’s present, the module will be loaded.
This new threat exploits the LogoFAIL vulnerability (CVE-2023-40238), a UEFI firmware flaw, to bypass Secure Boot protections and inject malicious payloads.
The bootkit is an advanced rootkit that is capable of replacing the boot loader and of patching the kernel ahead of its execution.
the shellcode restores the original instructions, hiding the exploit activity and effectively clearing all traces of the bootkit.
11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications could be abused to bypass Secure Boot on most systems using the modern firmware standard.
Attackers could bypass UEFI Secure Boot on a wide range of systems thanks to 11 Microsoft-signed UEFI shim bootloaders carrying vulnerabilities that have remained buried for more than a decade... Exploitation allows untrusted code to run during boot, opening the door to UEFI bootkits ... even with Secure Boot switched on.
The exploit uses embedded shellcode within a BMP image to bypass Secure Boot protections by injecting rogue certificates into the MokList variable.
По MITRE ATT&CK это одновременно Bootkit (T1542.003) для persistence и Code Signing Policy Modification (T1553.006) для defense evasion - Secure Boot формально включён, но фактически удалось его обойти.
The bootkit’s main goal is to disable the kernel’s signature verification feature... Another way to tell whether the bootkit is present on the system with UEFI Secure Boot enabled is by attempting to load an unsigned dummy kernel module during runtime. If it’s present, the module will be loaded.
The bootkit’s main goal is to disable the kernel’s signature verification feature... Another way to tell whether the bootkit is present on the system with UEFI Secure Boot enabled is by attempting to load an unsigned dummy kernel module during runtime. If it’s present, the module will be loaded.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named UEFI bootkit cited as malware that could be enabled by Secure Boot bypass via vulnerable Microsoft-signed shim bootloaders.
A malicious UEFI bootkit that could be deployed after bypassing Secure Boot via vulnerable Microsoft-signed shim bootloaders.
A malicious UEFI bootkit cited as an example of malware that could be deployed after bypassing UEFI Secure Boot.
A named UEFI bootkit cited as malware that could be deployed after abusing vulnerable Microsoft-signed shim bootloaders to bypass Secure Boot.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.