ESPecter
ESPecter is a real-world UEFI bootkit publicly analyzed by ESET in 2021. It persists on the EFI System Partition by patching the legitimate Windows Boot Manager, including bootmgfw.efi and the fallback bootloader bootx64.efi, and supports Windows 7 through Windows 10. Its UEFI persistence requires Secure Boot to be disabled or otherwise bypassed; ESET stated it was unknown how operators achieved this on affected systems, though possible scenarios included physical access, pre-disabled Secure Boot, or exploitation of UEFI firmware vulnerabilities. ESET also noted Lenovo firmware vulnerabilities (CVE-2021-3970, CVE-2021-3971, CVE-2021-3972) could facilitate deployment of SPI flash or ESP implants such as ESPecter.
ESPecter executes early in the boot chain by modifying Windows Boot Manager in memory. It patches BmFwVerifySelfIntegrity to force signature verification success, detours Archpx64TransferTo64BitApplicationAsm to modify the OS loader, reallocates its code using BlImgAllocateImageBuffer or BlMmAllocateVirtualPages so it survives UEFI application unload, and inserts a detour to OslArchTransferToKernel to patch the Windows kernel before execution. It bypasses Windows Driver Signature Enforcement by patching SepInitializeCodeIntegrity in memory, allowing it to load an unsigned kernel driver; it also patches MiComputeDriverProtection, although ESET could not determine that patch’s purpose.
The malware was assessed as primarily used for espionage. ESET observed it with user-mode components associated with keylogging and document theft. The kernel driver is dropped as \SystemRoot\System32\null.sys in the UEFI variant and creates the device \Device\WebBK. It supports IOCTL 0x22C004 to register an APC routine for processing intercepted keystrokes and captures keystrokes by setting a CompletionRoutine for IRP_MJ_READ requests on \Device\KeyboardClass0. The driver injects WinSys.dll into svchost.exe and Client.dll into winlogon.exe. WinSys.dll communicates with C2 over HTTPS using requests such as /Heart.aspx, /GetSysteminfo.aspx, /UpLoad.aspx, and /ModifyIpaddr.aspx. Client.dll communicates over custom TCP using single-byte XOR encryption; the analyzed campaign used XOR key 0x66. Client.dll supports command execution, power actions, screenshots, filesystem operations, data upload, service and process operations, configuration changes, and keylogger control, and it performs automatic exfiltration including document theft, keylogging, and periodic screenshots.
ESPecter stores an encrypted configuration as \SystemRoot\Temp\syslog in the UEFI variant, using a one-byte XOR key with Base64 encoding/decoding in WinSys.dll. ESET traced the malware’s roots to at least 2012. Earlier legacy BIOS versions persisted by modifying the MBR, hooking BIOS INT13h disk services, intercepting loading of bootmgr, storing encrypted configuration in hidden disk sector 5, and dropping drivers as \SystemRoot\System32\drivers\beep.sys on x86 or \SystemRoot\System32\drivers\null.sys on x64.
Attribution remains unconfirmed. ESET could not attribute ESPecter to a known threat actor, though Chinese debug messages in a client component suggested, with low confidence, a Chinese-speaking operator. ESET detections include EFI/Rootkit.ESPecter, Win32/Rootkit.ESPecter, and Win64/Rootkit.ESPecter. Reported infrastructure and indicators included C2 IPs 196.1.2[.]111, 103.212.69[.]175, 183.90.187[.]65, and 61.178.79[.]69; domains swj02.gicp[.]net, server.microsoftassistant[.]com, yspark.justdied[.]com, and crystalnba[.]com; and compromised Windows Boot Manager sample hashes 27AD0A8A88EAB01E2B48BA19D2AAABF360ECE5B8 and 8AB33E432C8BEE54AE759DFB5346D21387F26902.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Persistence
4 techniques
Persistence
“DefaultConfig value in HKLM\SYSTEM\CurrentControlSet\Control registry… can be used… to store configuration.”
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
9 techniques
Stealth
“WinSys.dll is an MPRESS-packed DLL embedded in the driver’s binary in an encrypted form.”
“installers… copy cmd.exe to con1866.exe to evade detection.”
“Execution of both WinSys.dll and Client.dll libraries is achieved by injecting them into svchost.exe and winlogon.exe… NotifyRoutine hooks the entry point… responsible for loading and executing the appropriate payload DLL.”
“ESPecter uses single-byte XOR with subtraction to decrypt user-mode payloads… configuration… one-byte XOR key… Base64 decodes… XORs…”
“can be configured to postpone C&C communication after execution or to communicate… only in a specified time range.”
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
“ESET researchers have analyzed a previously undocumented, real-world UEFI bootkit that persists on the EFI System Partition (ESP)… Today, we describe our recent discovery of ESPecter… a UEFI bootkit persisting on the ESP in the form of a patched Windows Boot Manager…”
Defense Impairment
3 techniques
Defense Impairment
“DefaultConfig value in HKLM\SYSTEM\CurrentControlSet\Control registry… can be used… to store configuration.”
Credential Access
1 technique
Credential Access
Discovery
8 techniques
Discovery
“reports foreground window names along with keylogger information to provide application context.”
“check for installed software under… HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall.”
“Client.dll component can list running processes and their loaded modules.”
“Upload various system info (CPU name, OS version, memory size, ethernet MAC address, list of installed software, etc.).”
“Client.dll component can list file information for specific directories.”
Collection
5 techniques
Collection
“can collect files with specified extension from removable drives.”
“Interception of keystrokes is done by setting up CompletionRoutine for IRP_MJ_READ requests for the keyboard driver object \Device\KeyboardClass0… Client… register its logging function by sending IOCTL 0x22C004.”
Command and Control
5 techniques
Command and Control
“WinSys.dll communicates with its C&C using HTTPS… https://<ip>/Heart.aspx?…”
“For communication with the C&C, it uses the TCP protocol…”
Exfiltration
3 techniques
Exfiltration
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named UEFI bootkit identified as part of newer bootkit discoveries.
A real UEFI bootkit discovered in the wild in 2021, cited as part of the progression of publicly known UEFI bootkits targeting Windows systems.
Referenced as a previously discovered fully featured UEFI bootkit; no additional technical details provided in this content.
UEFI malware/implant referenced as an ESP (EFI System Partition) or firmware-level threat that can be deployed when SPI flash protections or Secure Boot are disabled.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.