ESET researchers have identified “Bootkitty,” the first known UEFI bootkit developed to target Linux systems. The malware, uploaded to VirusTotal in November 2024, represents a significant shift in bootkit threats, which until now had focused exclusively on Windows platforms.
Bootkitty exploits vulnerabilities in UEFI firmware to bypass Secure Boot protections and compromise the Linux kernel, raising new security concerns for enterprises relying on Linux environments.
A bootkit is a type of advanced malware that targets the boot sector of a computer’s drive, specifically the Master Boot Record (MBR) or the Volume Boot Record (VBR). This allows the bootkit to load before the operating system starts, giving it control over the boot process and enabling it to evade detection by traditional security measures that operate within the OS environment
A Landmark in UEFI Malware Evolution
The discovery of Bootkitty signals an evolution in UEFI bootkits. Traditionally aimed at Windows systems, UEFI bootkits are prized by attackers for their ability to evade detection by operating system-based security tools.
Bootkitty marks the first instance of such malware targeting Linux. According to ESET telemetry, there is no evidence of Bootkitty being deployed in active attacks, suggesting that it remains in early development. However, its discovery highlights the growing interest of cybercriminals in exploiting Linux platforms, which have gained prominence in enterprise environments.
How Bootkitty Operates
Bootkitty’s sophistication lies in its ability to compromise the system before the operating system loads, effectively bypassing Secure Boot—a critical UEFI feature designed to ensure only trusted software is executed during the boot process. By hooking UEFI security authentication protocols like EFI_SECURITY_ARCH_PROTOCOL and modifying the GRUB bootloader’s integrity checks, Bootkitty disables kernel signature verification.
The malware also manipulates environment variables to inject malicious libraries into system processes. Specifically, it replaces the first environment variable with LD_PRELOAD=/opt/injector.so, ensuring that its payload is loaded automatically upon system startup. Additionally, Bootkitty intercepts the Linux kernel’s module verification function (module_sig_check), forcing it to return a “success” status for unsigned modules.
Despite its advanced techniques, Bootkitty exhibits notable limitations. It relies on hardcoded offsets tied to specific versions of the GRUB bootloader and Linux kernel, rendering it unstable and prone to system crashes. ESET researchers describe it as a proof-of-concept rather than a fully operational malware strain.
Artifacts and the BlackCat Connection
ESET’s analysis uncovered several artifacts within Bootkitty’s code, including ASCII art referencing the name “BlackCat” and a list of potential authors. These details raise questions about its origin. However, ESET clarified that this BlackCat reference is unrelated to the infamous ransomware group of the same name, which primarily develops Rust-based malware. Bootkitty’s codebase, written in C, supports this distinction.
Alongside Bootkitty, ESET identified a related kernel module dubbed “BCDropper“. This module deploys “BCObserver“, an ELF binary with rootkit capabilities. BCObserver can hide files, processes, and network ports, enhancing the stealth of malicious activity on compromised systems. While circumstantial evidence links BCDropper to Bootkitty, their exact relationship remains unconfirmed.
A Historical Perspective on UEFI Bootkits
The concept of UEFI bootkits is not new. The first proof-of-concept UEFI bootkit emerged in 2012, designed to demonstrate vulnerabilities in modern firmware systems. Real-world examples followed years later, with ESPecter discovered in 2021 and BlackLotus in 2022. These malware strains exclusively targeted Windows systems, exploiting Secure Boot vulnerabilities to execute unauthorized code. Bootkitty’s emergence as the first Linux-focused UEFI bootkit marks a significant expansion in the scope of these threats.
Related: Researchers Find Malware-Threatening Secure Boot Bypass in Hundreds of Devices
On Windows, bootkits like BlackLotus and Glupteba represent significant security threats due to their ability to control the boot process and disable security features. BlackLotus is particularly notorious for being the first publicly known malware to bypass Secure Boot on fully updated Windows systems by exploiting a specific vulnerability, allowing it to disable critical security protections and install malicious components.
| Related: Microsoft Tackles Kerberos and BlackLotus Vulnerabilities in Latest Security Update Microsoft Issues Fix for Windows 11 and 10 “BlackLotus” UEFI Secure Boot Vulnerability |
It is sold on the dark web, making it accessible to sophisticated attackers. Glupteba, on the other hand, is a modular malware that uses a UEFI bootkit to enhance its stealth and persistence by embedding itself in system firmware, making it difficult to detect and remove. Both bootkits demonstrate advanced techniques that exploit firmware vulnerabilities to maintain control over infected systems.
Implications for Linux Security
The discovery of Bootkitty underscores the need for robust security measures in Linux environments. Linux, once perceived as a less attractive target for malware developers, has seen growing adoption in enterprises, making it an increasingly valuable target. Bootkitty’s development suggests that attackers are adapting to this shift, leveraging advanced techniques to exploit Linux-specific vulnerabilities.
Martin Smolár, the ESET researcher who led the analysis, emphasized the importance of proactive security measures. “To keep your Linux systems safe from such threats, make sure that UEFI Secure Boot is enabled, your system firmware, security software, and OS are up-to-date, and so is your UEFI revocations list,” he advised. For organizations managing Linux infrastructure, these steps are critical to mitigating the risks posed by emerging threats like Bootkitty.
The UEFI revocation list, also known as the Secure Boot Forbidden Signature Database (dbx), is a critical component in maintaining the security of systems using UEFI Secure Boot. It contains signatures of firmware and software that have been revoked due to vulnerabilities or security issues, ensuring they cannot be used to boot a system.
Updates to the dbx are typically performed by operating systems or as part of firmware updates, and they play a crucial role in protecting systems from boot-level malware and exploits
Recommendations for Protection
To defend against threats like Bootkitty, ESET recommends enabling UEFI Secure Boot to prevent unsigned bootloaders from executing. Regular updates to firmware, operating systems, and the UEFI revocation list are essential. Administrators should also monitor systems for anomalies, such as unauthorized kernel module loading or tampered GRUB bootloader files.
In cases where Bootkitty is suspected, ESET suggests restoring legitimate GRUB files as a remedy. For example, if Bootkitty replaces /EFI/ubuntu/grubx64.efi, the original file (/EFI/ubuntu/grubx64-real.efi) can be restored to its rightful location.
Forensic Indicators and Technical Resources
ESET has shared technical details and indicators of compromise (IoCs) for Bootkitty and BCDropper on a dedicated Bootkitty GitHub repository. Administrators and security researchers can use these resources to detect and mitigate potential infections.
