Loading story…
Researchers detailed HDRoot, a stealthy Windows bootkit installer tied to Winnti activity that was disguised as Microsoft's net.exe, protected with VMProtect, and signed with a compromised certificate from Guangzhou YuanLuo Technology. The malware installs code into the MBR and subsequent boot sectors, then alters the startup chain so a malicious DLL is injected early in the boot process and a designated backdoor is launched with persistence.
HDRoot supports both FAT32 and NTFS systems and commonly hides its DLL in Windows paths such as %windir%\WMSysPr9.prx, while modifying ServiceDll registry values for legitimate services including wuauserv, LanManServer, schedule, and winmgmt. Some variants drop the payload as %windir%\temp\svchost.exe, while others execute it directly from memory to reduce forensic traces; despite its sophistication, the bootkit leaves detectable artifacts such as broken Windows services and persistent malicious ServiceDll paths.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers identified an observed HDD Rootkit/HDRoot sample carrying version number 1.2 dated 22 August 2006, providing the earliest explicit time anchor for the malware discussed. The sample was later analyzed as a bootkit installer linked to Winnti activity.
While analyzing Winnti group activity, researchers found a suspicious Win64 sample masquerading as Microsoft's net.exe, protected with VMProtect and signed with a compromised Guangzhou YuanLuo Technology certificate. Memory analysis and comparison with an unprotected sample confirmed it was an HDD Rootkit bootkit installer, which they named HDRoot.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how the **HDRoot** bootkit infects Windows systems during early boot and installs a backdoor before the operating system fully loads, giving attackers stealthy persistence and control. The activity was linked primarily to the **Winnti** group, and analysis identified a **Derusbi**-based payload that includes a kernel driver and remote shell module. The malware persists by hijacking legitimate Windows services, stores encrypted configuration data in the registry, and can operate in a listening mode while a signed rootkit driver hides files and network activity and redirects specially crafted packets to the implant. A second intrusion chain used HDRoot alongside a downloader that fetched additional executables from multiple URLs, created a fake **Winlogon** service for persistence, and attempted to remove South Korean antivirus products. Victims were concentrated in **Southeast Asia**, especially **South Korea**, with additional infections observed in **Russia** and the **UK**. Researchers said the installer’s standalone design suggests HDRoot could be reused beyond Winnti operations by other advanced threat actors.
Aug 14, 2026
Check Point Research disclosed that Microsoft Defender’s Boot-Time Removal driver, **`BTR.sys`**, can be repurposed as a Microsoft-signed kernel primitive for arbitrary file and registry operations, allowing attackers with administrator rights and **`SeLoadDriverPrivilege`** to tamper with protected security components during early startup. The researchers reverse engineered the driver’s undocumented transaction protocol, including its **RC4-encrypted** format and **`:changelist`** alternate data stream, and released the **`BTR_CLI`** proof-of-concept to generate valid transactions and stage the driver across Windows 7 through Windows 11 25H2. The technique does not rely on a memory-corruption flaw or traditional bring-your-own-vulnerable-driver abuse, but instead uses a trusted built-in Windows component that is not covered by Microsoft’s vulnerable driver block rules or common LOLDrivers-style blocking approaches. Researchers said the boot-time execution window could let attackers delete or move files such as **`WdFilter.sys`** and **`MsMpEng.exe`**, or modify service-related registry keys before higher-level protections fully initialize; they reported no observed in-the-wild exploitation and recommended focusing on behavioral detection, monitoring **ADS `:changelist` creation**, unusual **`BTR.sys`** loads, suspicious service staging, **`BootClean.log`** artifacts, and tighter control of **`SeLoadDriverPrivilege`**.
Aug 26, 2026
Researchers reported a renewed **Rovnix** malware campaign that used coronavirus-themed documents referencing a World Bank initiative to lure victims into opening a self-extracting archive. The package delivered a decoy file alongside a dropper that unpacked updated Rovnix-derived components, then used a **UAC bypass** based on a fake trusted directory and **DLL hijacking** via `wusa.exe` and a malicious `wtsapi32.dll` to gain execution while evading defenses. The malware then installed a **bootkit** by overwriting the **VBR**, deployed the **KLoader** driver to inject a loader into running processes, and sent XOR-encrypted system data to command-and-control servers. Researchers also identified related loader variants that reused the same privilege-escalation technique without the bootkit, as well as payloads that acted as a backdoor capable of executing files, recording microphone audio, and rebooting or shutting down infected systems, indicating that leaked Rovnix source code had been adapted into a more modern intrusion toolset.
Aug 14, 2026