Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Diving Into Glupteba's UEFI Bootkit

Summary: Unit 42 documented a previously unreported UEFI bootkit in Glupteba, used in a campaign around November 2023, that writes a recompiled version of the open-source EfiGuard into the EFI system partition and replaces the Windows Boot Manager with Loader.efi to disable PatchGuard and driver signature enforcement before Windows starts. Glupteba, active for over a decade and disrupted by Google in December 2021, reemerged in a widespread 2023 campaign hitting organizations in countries including Greece, Nepal, Bangladesh, Brazil, Korea, Algeria, Ukraine, Slovakia, Turkey, Italy and Sweden, distributed largely through pay-per-install services and fake software installers.

What's compelling: An implant in the EFI system partition runs before Windows and any security product, and Unit 42 found no evidence Glupteba bypasses Secure Boot, so the boot chain itself is the exposed surface. The installer can fall back to DSEFix, UPGDSED or EfiGuard depending on architecture, OS version and configuration, meaning a single blocked path does not close the infection.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related