Loading story…
Researchers detailed how the HDRoot bootkit infects Windows systems during early boot and installs a backdoor before the operating system fully loads, giving attackers stealthy persistence and control. The activity was linked primarily to the Winnti group, and analysis identified a Derusbi-based payload that includes a kernel driver and remote shell module. The malware persists by hijacking legitimate Windows services, stores encrypted configuration data in the registry, and can operate in a listening mode while a signed rootkit driver hides files and network activity and redirects specially crafted packets to the implant.
A second intrusion chain used HDRoot alongside a downloader that fetched additional executables from multiple URLs, created a fake Winlogon service for persistence, and attempted to remove South Korean antivirus products. Victims were concentrated in Southeast Asia, especially South Korea, with additional infections observed in Russia and the UK. Researchers said the installer’s standalone design suggests HDRoot could be reused beyond Winnti operations by other advanced threat actors.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers identified a second HDRoot-associated payload as a one-click installer dropper that bundled HDRoot with a backdoor. The sample was compiled on November 18, 2013.
The stolen XL Games certificate used to sign the HDRoot-associated driver was revoked. The report gives the revocation date as June 21, 2013.
The rootkit driver associated with an HDRoot-installed Derusbi payload was signed with a stolen certificate from South Korean gaming company XL Games. The report states the signing occurred on December 19, 2012.
The report states that known HDRoot infections were concentrated in Southeast Asia, especially South Korea, with additional victims observed in regions including Russia and the UK. This expanded the known geographic scope of the activity.
Researchers found another HDRoot-associated payload in a standalone dropper containing both HDRoot and the installed backdoor. This chain acted as a downloader to retrieve additional malware and establish persistence.
Researchers manually extracted one HDRoot-associated payload family from victim hard drives where the bootkit was detected. They identified it as a server-side Derusbi variant with a kernel driver and remote shell module.
While tracking Winnti group activity, researchers encountered a suspicious standalone utility named HDD Rootkit that installs the HDRoot bootkit. They linked the observed HDRoot activity primarily to the Winnti group and documented associated payload families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **HDRoot**, a stealthy Windows bootkit installer tied to **Winnti** activity that was disguised as Microsoft's `net.exe`, protected with **VMProtect**, and signed with a compromised certificate from **Guangzhou YuanLuo Technology**. The malware installs code into the **MBR** and subsequent boot sectors, then alters the startup chain so a malicious DLL is injected early in the boot process and a designated backdoor is launched with persistence. HDRoot supports both **FAT32** and **NTFS** systems and commonly hides its DLL in Windows paths such as `%windir%\WMSysPr9.prx`, while modifying `ServiceDll` registry values for legitimate services including **wuauserv**, **LanManServer**, **schedule**, and **winmgmt**. Some variants drop the payload as `%windir%\temp\svchost.exe`, while others execute it directly from memory to reduce forensic traces; despite its sophistication, the bootkit leaves detectable artifacts such as broken Windows services and persistent malicious `ServiceDll` paths.
Aug 14, 2026
Security researchers and incident responders have tied a broad set of espionage and intrusion activity to the **Winnti** ecosystem, a China-linked threat cluster active for years against gaming companies, software vendors, and enterprise networks worldwide. Early reporting described intrusions used to steal source code, digital certificates, and other intellectual property, while later investigations connected the same ecosystem to major supply-chain compromises including **CCleaner**, **NetSarang**, **ShadowHammer**, and other software incidents. Researchers also found evidence that some operations monetized access through cryptocurrency mining and in-game fraud, and that operators tailored malware configurations to specific victims and campaigns. Technical analysis shows Winnti operators evolving their tooling and infrastructure with modular backdoors such as **PortReuse**, **ShadowPad**, and newer malware linked with moderate confidence such as **Glutton**, while continuing to hide command-and-control through methods including GitHub-hosted encrypted C2 data, passive backdoors on common service ports, and rootkit-assisted traffic rerouting via **NdisReroute**. Defenders published multiple ways to detect the threat, including YARA rules, configuration parsers, PCAP and live-network detectors for the distinctive Winnti `HELO` handshake, Nmap scripts that can identify infected hosts and extract host metadata, and internet-scale tracking of **Winnti 4.0** and ShadowPad servers. VMware reported dozens of active Winnti 4.0 servers still online, underscoring that the malware family’s infrastructure remains persistent and operational.
Aug 15, 2026
ESET reported that the **Winnti Group** used a previously unanalyzed passive backdoor called **PortReuse** and tied it to a broader malware arsenal that also includes updated **ShadowPad** variants and a **VMProtect**-based launcher. PortReuse injects into processes already listening on common ports, waits for a magic packet, and covertly enables attacker control while forwarding legitimate traffic, helping it blend into normal network activity. The launcher decrypts either PortReuse or ShadowPad payloads with **RC5** keys derived from the victim machine’s volume serial number, a technique ESET said reinforced the technical links across the toolset. The research connected multiple high-profile software supply-chain compromises—including **CCleaner**, **NetSarang**, **Asus ShadowHammer**, and several 2018 compromised games and software incidents—to the same broader Winnti ecosystem through shared tooling, cryptography, and tradecraft. ESET also said some of the 2018 third-stage payloads were **XMRig** Monero miners, indicating cryptocurrency mining as one operational objective. With assistance from **Censys**, the company identified eight Internet-facing systems matching PortReuse’s HTTP signature at a major Asian mobile hardware and software manufacturer and said it notified the victim.
Aug 14, 2026