Loading malware…
Gapz, also known as Win32/Gapz, is a Windows bootkit that combines boot-chain persistence, kernel-mode functionality, hidden encrypted storage, and stealthy process injection. Two variants with different boot infection methods are known. One variant modifies only the Hidden Sectors field in the NTFS Volume Parameter Block, redirecting boot-time execution to malicious code stored outside the normal partition area while minimizing changes to the Volume Boot Record.
Gapz uses Extra Window Memory Injection, a technique also associated with PowerLoader, to execute malicious code inside Windows Explorer. The technique abuses shared memory and the Explorer tray window’s extra window memory to redirect execution within a trusted process. Gapz’s use of this injection approach enabled it to evade host-based intrusion prevention systems.
Its kernel-mode component consists of position-independent code blocks implementing cryptography, hooking, hidden storage, payload management, and networking. Gapz maintains a FAT32-formatted hidden storage container and encrypts its sectors with AES-256 in CBC mode. It implements custom kernel-mode networking through the NDIS miniport layer to bypass personal firewalls and traffic-monitoring software, and communicates with command-and-control servers over HTTP using encrypted messages.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
The first bootkits started to emerge on the malware scene as cybercriminals realized that bootkit development was a way in which they could increase the profitability of a kernel-mode rootkit by widening the range of its targets to include users of 64-bit machines.
To keep the information stored within the hidden storage secret, its content is encrypted. The malware utilizes AES with key length 256 bits in CBC (Cipher Block Chaining) mode to encrypt/decrypt each sector of the hidden storage.
Most antiviruses don’t treat all processes the same... the goal of malware is to inject code into one of these “trusted” processes... In the case of PowerLoader, the trusted process targeted is explorer.
All bootkits aim to modify and subvert operating system components before the OS can be loaded. The most interesting target components are as follows: BIOS/UEFI, MBR (Master Boot Record) and the operating system boot loader.
So as to store payload and configuration information secretly Win32/Gapz implements hidden storage.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a complex threat that adopted TDL3’s hidden storage approach.
Malware noted here for using a novel code injection technique to bypass host-based intrusion prevention systems; also described as first using the PowerLoader technique.
Mentioned as background for a code-injection technique. The author speculates that the Gapz technique was created to bypass restrictions introduced by User Interface Privilege Isolation (UIPI); the article primarily describes a separate window-property-based injection technique.
Mentioned as a historical example of earlier bootkits during the peak bootkit era.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.