Loading malware…
ESPecter is a real-world Windows UEFI bootkit used primarily for espionage. It persists by modifying Windows Boot Manager on the EFI System Partition, allowing execution early in the boot chain before the operating system fully starts. Earlier variants date back to at least 2012 and used legacy BIOS and MBR-based persistence, while later variants added UEFI-capable persistence by patching boot components on the EFI System Partition.
The bootkit is designed to bypass Windows Driver Signature Enforcement by patching boot and kernel code in memory, enabling the loading of an unsigned kernel driver. During boot, it modifies Windows Boot Manager integrity and transfer routines, survives the unload of the initial UEFI application by reallocating its code, and patches kernel code integrity initialization before control passes to the Windows kernel. The kernel component then supports further malicious activity, including user-mode payload injection and keylogging support.
ESPecter has been observed with user-mode espionage components that provide command-and-control, payload download and execution, document theft, screenshot capture, filesystem and process operations, service manipulation, and automated data exfiltration. Its driver intercepts keyboard input to support keylogging and injects user-mode modules into system processes to run its surveillance and remote-control functionality.
The malware targets Windows systems across multiple versions from Windows 7 through Windows 10. Its UEFI persistence method requires Secure Boot to be disabled or otherwise bypassed, although the exact method used by operators to achieve this on victim systems has not been determined. Possible paths include physical access, pre-disabled Secure Boot, or exploitation of firmware weaknesses, but attribution remains unconfirmed. Chinese-language debug strings in one client component have been noted, suggesting only low-confidence indications of a Chinese-speaking operator.
ESPecter is notable as one of the first real UEFI bootkits publicly documented in the wild and illustrates the operational transition from legacy bootkits to modern firmware- and ESP-resident threats that combine pre-OS persistence with post-boot espionage capabilities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
“DefaultConfig value in HKLM\SYSTEM\CurrentControlSet\Control registry… can be used… to store configuration.”
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
Typical targets are like kernel structures, device drivers, MBR or boot sectors, which they do with techniques SSDT hooking, DKOM, file hiding, process hiding, and rootkit loaders in kernel space.
“WinSys.dll is an MPRESS-packed DLL embedded in the driver’s binary in an encrypted form.”
“installers… copy cmd.exe to con1866.exe to evade detection.”
“Execution of both WinSys.dll and Client.dll libraries is achieved by injecting them into svchost.exe and winlogon.exe… NotifyRoutine hooks the entry point… responsible for loading and executing the appropriate payload DLL.”
“ESPecter uses single-byte XOR with subtraction to decrypt user-mode payloads… configuration… one-byte XOR key… Base64 decodes… XORs…”
“can be configured to postpone C&C communication after execution or to communicate… only in a specified time range.”
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
“DefaultConfig value in HKLM\SYSTEM\CurrentControlSet\Control registry… can be used… to store configuration.”
“reports foreground window names along with keylogger information to provide application context.”
“check for installed software under… HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall.”
“Client.dll component can list running processes and their loaded modules.”
“Upload various system info (CPU name, OS version, memory size, ethernet MAC address, list of installed software, etc.).”
“Client.dll component can list file information for specific directories.”
“can collect files with specified extension from removable drives.”
“Interception of keystrokes is done by setting up CompletionRoutine for IRP_MJ_READ requests for the keyboard driver object \Device\KeyboardClass0… Client… register its logging function by sending IOCTL 0x22C004.”
“WinSys.dll communicates with its C&C using HTTPS… https://<ip>/Heart.aspx?…”
“For communication with the C&C, it uses the TCP protocol…”
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Bootkit/tool cité comme source d’inspiration pour RedLotus.
A named UEFI bootkit identified as part of newer bootkit discoveries.
A UEFI firmware bootkit mentioned as an in-the-wild example of stealthy malware operating beneath the operating system.
A real UEFI bootkit discovered in the wild in 2021, cited as part of the progression of publicly known UEFI bootkits targeting Windows systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.