[Intel]: https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/

Area

Malware reports

Parent threat

Resource Development, Persistence, Defense Evasion

Finding

https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/

Industry reference

attack:T1542.003:Bootkit
attack:T1547.006:Kernel Modules and Extensions
attack:T1587.00:Malware
attack:T1587.002Code Signing Certificates
attack:T1106:Native API
attack:T1129:Shared Modules
attack:T1574.006:Dynamic Linker
attack:T1542.003
attack:T1014:Rootkit
attack:T1562:Impair Defenses
attack:T1564:Hide Artifacts

Malware reference

Bootkitty
BCDropper
BCObserver

Actor reference

No response

Component

Linux

Scenario

Consumer, Internal enterprise services, Enterprise with satellite facilities, Enterprise with contracted services and/or non-employee access