Going Below the OS: Bootkits and UEFI Implants
- A bootkit infects code that runs before the OS kernel — the boot loader or firmware — so it is already in control when defenses start.
- UEFI implants live in SPI flash on the motherboard: they survive OS reinstalls and even disk replacement.
- Real-world examples: LoJax (first in-the-wild UEFI rootkit, 2018), MoonBounce, BlackLotus (2023, bypassed Secure Boot).
- Countermeasure: Secure Boot verifies each stage's signature; firmware write-protection and measured boot (TPM) raise the bar further.
Key Takeaway
The modern trend is downward — attackers seek pre-OS persistence where the OS cannot see or clean them.