CosmicStrand UEFI malware present in Gigabyte, ASUS motherboards
Chinese language-speaking hackers have been utilizing since at the least 2016 malware that lies nearly undetected within the firmware photos for some motherboards, some of the persistent threats generally referred to as a UEFI rootkit.
Researchers at cybersecurity firm Kaspersky known as it CosmicStrand however an earlier variant of the menace was found by malware analysts at Qihoo360, who named it Spy Shadow Trojan.
It’s unclear how the menace actor managed to inject the rootkit into the firmware photos of the goal machines however researchers discovered the malware on machines with ASUS and Gigabyte motherboards.
Thriller UEFI rootkit
The Unified Extensible Firmware Interface (UEFI) software program is what connects a pc’s working system with the firmware of the underlying {hardware}.
UEFI code is the primary to run throughout a pc’s booting sequence, forward of the working system and the safety options obtainable.
Malware planted within the UEFI firmware picture shouldn’t be solely tough to determine however can also be extraordinarily persistent because it can’t be eliminated by reinstalling the working system or by changing the storage drive.
A report from Kaspersky as we speak gives technical particulars about CosmicStrand, from the contaminated UEFI part to deploying a kernel-level implant right into a Home windows system at each boot.
The whole course of consists of establishing hooks to switch the working system loader and take management of the complete execution move to launch the shellcode that fetches the payload from the command and management server.
supply: Kaspersky
Mark Lechtik, a former Kaspersky reverse engineer, now at Mandiant, who was concerned within the analysis, explains that the compromised firmware photos got here with a modified CSMCORE DXE driver, which permits a legacy boot course of.
“This driver was modified in order to intercept the boot sequence and introduce malicious logic to it,” Lechtik notes in a tweet on Monday.
Whereas the CosmicStrand variant Kaspersky found is newer, researchers at Qihoo360 disclosed in 2017 the primary particulars about an early model of the malware.
The Chinese language researchers received to analyzing the implant after a sufferer reported that their laptop had created a brand new account out of the blue and the antivirus software program saved alerting of a malware an infection.
In accordance with their report, the compromised system ran on a second-hand ASUS motherboard that the proprietor had bought from an internet retailer.
Kaspersky was in a position to decide that the CosmicStrand UEFI rootkit was lodged in firmware photos of Gigabyte or ASUS motherboards which have in frequent designs utilizing the H81 chipset.
This refers to previous {hardware} between 2013 to 2015 that’s largely discontinued as we speak.
It’s unclear how the implant was positioned on the contaminated computer systems for the reason that course of would contain both bodily entry to the system or via a precursor malware able to routinely patching the firmware picture.
Victims recognized by Kaspersky additionally present few clues concerning the menace actor and their goal for the reason that recognized contaminated techniques belong to non-public people in China, Iran, Vietnam, and Russia that would not be linked to a corporation or business.
supply: Kaspersky
Nonetheless, the researchers related CosmicStrand to a Chinese language-speaking actor based mostly on code patterns that have been additionally seen within the MyKings cryptomining botnet, the place malware analysts at Sophos discovered Chinese language-language artifacts.
Kaspersky says that the CosmicStrand UEFI firmware rootkit can persist on the system for the complete lifetime of the pc and has been utilized in operations for years, for the reason that finish of 2016.
UEFI malware turning into extra frequent
The primary widespread report a few UEFI rootkit discovered within the wild, LoJax, got here in 2018 from ESET and it was utilized in assaults by Russian hackers within the APT28 group (a.okay.a. Sednit, Fancy Bear, Sofacy).
Virtually 4 years later and accounts of UEFI malware assaults within the wild have grown extra frequent, and it wasn’t simply superior hackers exploring this feature:
We realized about MosaicRegressor from Kaspersky in 2020, though it was utilized in assaults in 2019 towards non-governmental organizations.
On the finish of 2020 got here the information that TrickBot builders had created TrickBoot, a brand new module that checked compromised machines for UEFI vulnerabilities.
One other UEFI rootkit was revealed in late 2021 to be developed by the Gamma Group as a part of their FinFisher surveillance answer.
The identical 12 months, particulars emerged from ESET about one more bootkit known as ESPecter, believed for use primarily for espionage and with origins way back to 2012.
MoonBounce, thought-about to be some of the subtle UEFI firmware implants, was disclosed this 12 months in January as being utilized by Winnti, a Chinese language-speaking hacker group (often known as APT41).
