Loading story…
Researchers analyzed an updated Rovnix bootkit framework variant, Rovnix.D, that continues the malware family’s use of NTFS VBR infection to load unsigned kernel-mode drivers on 64-bit Windows systems. The newer samples include BkSetup.dll version 2.4 and show revised polymorphic bootstrap code, modified malicious VBR storage, and updated driver decryption routines designed to make detection and analysis harder.
The refreshed framework also adds support for downloading multiple payloads from command-and-control infrastructure, with the payload communicating through a malicious driver and hidden storage before reaching out to rtttt-windows.com. Researchers assessed the changes as evolutionary rather than a full redesign, but said the updates appear aimed at improving antivirus evasion and keeping the bootkit viable for renewed criminal use, including possible botnet-for-rent operations.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The analyzed newer sample contained the Rovnix bootkit's BkSetup.dll installer module with file version 2.4 and a compilation timestamp dated 24/06/2012. The article presents this as evidence of continued development of the Rovnix framework.
The author's team had been tracking the Rovnix bootkit family since April 2011. Rovnix was notable for using NTFS VBR infection to load unsigned kernel-mode drivers on x64 systems.
The Rovnix framework was sold to Carberp developers associated with the Hodprot/Origami botnet, and those developers used droppers incorporating the Rovnix bootkit framework until the end of 2011.
Early Rovnix samples that blocked internet access for Russian users and demanded payment by premium SMS stopped using the bootkit component during the summer of 2011.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a renewed **Rovnix** malware campaign that used coronavirus-themed documents referencing a World Bank initiative to lure victims into opening a self-extracting archive. The package delivered a decoy file alongside a dropper that unpacked updated Rovnix-derived components, then used a **UAC bypass** based on a fake trusted directory and **DLL hijacking** via `wusa.exe` and a malicious `wtsapi32.dll` to gain execution while evading defenses. The malware then installed a **bootkit** by overwriting the **VBR**, deployed the **KLoader** driver to inject a loader into running processes, and sent XOR-encrypted system data to command-and-control servers. Researchers also identified related loader variants that reused the same privilege-escalation technique without the bootkit, as well as payloads that acted as a backdoor capable of executing files, recording microphone audio, and rebooting or shutting down infected systems, indicating that leaked Rovnix source code had been adapted into a more modern intrusion toolset.
Aug 14, 2026
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
Researchers detailed **HDRoot**, a stealthy Windows bootkit installer tied to **Winnti** activity that was disguised as Microsoft's `net.exe`, protected with **VMProtect**, and signed with a compromised certificate from **Guangzhou YuanLuo Technology**. The malware installs code into the **MBR** and subsequent boot sectors, then alters the startup chain so a malicious DLL is injected early in the boot process and a designated backdoor is launched with persistence. HDRoot supports both **FAT32** and **NTFS** systems and commonly hides its DLL in Windows paths such as `%windir%\WMSysPr9.prx`, while modifying `ServiceDll` registry values for legitimate services including **wuauserv**, **LanManServer**, **schedule**, and **winmgmt**. Some variants drop the payload as `%windir%\temp\svchost.exe`, while others execute it directly from memory to reduce forensic traces; despite its sophistication, the bootkit leaves detectable artifacts such as broken Windows services and persistent malicious `ServiceDll` paths.
Aug 14, 2026