Loading story…
Researchers detailed Pitou (also known as Backboot), a Windows bootkit and spambot that infects the Master Boot Record (MBR) to gain persistence before the operating system loads. The malware targeted Windows XP through Windows 10 on both 32-bit and 64-bit systems, stored its loader and encrypted driver in the last 1 MB of disk space, and hooked multiple stages of the boot chain to bypass Microsoft kernel-mode code-signing protections and launch a fully kernel-mode spam bot. Analysts also found anti-VM checks, heavy obfuscation, and stealth features that hid the MBR infection by intercepting disk read and write requests.
Further reverse engineering showed Pitou’s command-and-control design was built for resilience. The malware contacted a primary TCP server at 195.154.237.14:7384, but could also fall back to a domain generation algorithm (DGA) implemented inside a custom virtual machine in kernel mode. Researchers reconstructed the VM, extracted the DGA, and found it generated batches of 20 date-seeded domains using encrypted character tables and mostly 10-day windows, although coding bugs affected some date handling and domain output. The recovered algorithm matched previously observed Pitou infrastructure, underscoring the sophistication of one of the last notable MBR bootkits seen in the wild.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The packed Pitou sample used in the DGA analysis had a compile timestamp of 31 October 2017 10:15:25 UTC.
The analyzed Pitou dropper sample was first submitted to VirusTotal on 23 September 2017 at 04:58:27, according to TG Soft.
TG Soft states that the analyzed Pitou dropper sample was found on 20 September 2017.
One analyzed Pitou dropper sample carried a compilation timestamp of 19 September 2017 20:55:31.
TG Soft reported analyzing new versions of Pitou that were observed in the wild from September to October 2017, indicating continued active development and deployment.
The Pitou unpacked executable analyzed in the DGA research had a compile timestamp of 22 August 2017 10:24:10 UTC.
The 64-bit Pitou rootkit module analyzed in the DGA research had a compile timestamp of 27 February 2017 06:13:41 UTC.
TG Soft's report states that the Pitou bootkit, also known as Backboot, was first released in April 2014.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 82 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **Pikabot** has evolved into a heavily obfuscated malware loader and core backdoor that uses layered string protection, dynamic API resolution, anti-analysis checks, and stealthy process injection. Recent reverse-engineering shows Pikabot decrypts strings through per-string `RC4`, modified `Base64`, and `AES-CBC`, while newer tooling can now automate recovery of keys, IVs, and encrypted arrays from samples. Analysts said the malware disguises itself as **SearchProtocolHost.exe**, walks the PEB to locate `kernel32.dll`, hashes API names, and uses indirect syscalls such as `NtAllocateVirtualMemory`, `NtWriteVirtualMemory`, and `NtResumeThread` to inject its core module into a suspended legitimate process. The recovered functionality shows Pikabot can profile hosts, enumerate processes, execute commands, manipulate files and the registry, and communicate with command-and-control servers over **WinINet** using HTTP POST requests. Earlier loader samples also established persistence with a scheduled task and a registry-stored PowerShell downloader that fetched a DLL, decoded it from Base64, and launched it with `regsvr32`, while newer samples extracted payload components from PNG resources before decryption and injection. Reporting on distribution linked Pikabot to spam thread-hijacking campaigns, malicious attachments and links, and malvertising that impersonated **AnyDesk**, with operators using commands such as `whoami.exe /all`, `ipconfig.exe /all`, and `netstat.exe -aon` to survey compromised systems.
Aug 15, 2026
Kaspersky reported that **TDL-4**, an advanced evolution of the TDSS malware family, combined **bootkit** persistence, a powerful **rootkit**, and custom-encrypted **HTTPS** communications to create one of the most resilient malware platforms of its time. The malware hid itself and other payloads, removed competing malware from infected systems, and blocked rival botnet infrastructure, while also supporting monetization through proxy services, search-result manipulation, and advertising fraud. Kaspersky’s analysis of backend databases indicated that **4,524,488 computers** were infected in the first three months of 2011, with nearly one-third of victims located in the United States. A key innovation was TDL-4’s use of the public **Kad** peer-to-peer network through the `kad.dll` module, allowing operators to distribute commands and maintain control even if traditional command-and-control servers were taken down. Additional components such as `Socks.dll` enabled proxy functionality and `cmd64.dll` added 64-bit support, extending the botnet’s reach and durability. Researchers said the architecture was designed to make the botnet effectively **indestructible**, underscoring how TDL-4 raised the bar for stealth, survivability, and criminal monetization in large-scale malware operations.
Jun 29, 2026
Researchers reported that **BlackLotus** is the first known in-the-wild UEFI bootkit able to bypass **UEFI Secure Boot** on fully updated Windows 11 and other UEFI systems. The malware abuses weaknesses tied to `CVE-2022-21894` and later `CVE-2023-24932`, allowing it to execute in the earliest software stage of boot, establish persistence across restarts, and evade normal remediation. ESET said BlackLotus had been advertised on underground forums since at least October 2022 and documented real-world samples that install a kernel driver and a user-mode payload, with follow-on capability for HTTP-based command-and-control and additional payload delivery.
Jun 29, 2026