{"uuid": "2302740c-4b0d-441b-94ad-d603acc66105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22005", "type": "seen", "source": "https://t.me/hacking_Attack/25452", "content": "Black Hat Ethical Hacking\nFinFisher malware hijacks Windows Boot Manager with UEFI bootkit\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png FinFisher malware hijacks Windows Boot Manager with UEFI bootkitPost Views: 156 \nReading Time: 1 Minute\nCommercially developed FinFisher malware now can infect Windows devices using a UEFI bootkit that it injects in the Windows Boot Manager. FinFisher\u00a0(also known as FinSpy and Wingbird) is a\u00a0surveillance solution developed by\u00a0Gamma Group that also comes with malware-like capabilities often found in spyware strains.\n\nIts developer says it\u2019s sold exclusively to\u00a0government agencies and\u00a0law enforcement worldwide, but cybersecurity firms have also detected it while being delivered via spearphishing campaigns\u00a0and the infrastructure of\u00a0Internet Service Providers (ISPs). Evasiveness and persistence powerhouse \u201cDuring our research, we found a UEFI bootkit that was loading FinSpy. All machines infected with the UEFI bootkit had the Windows Boot Manager (bootmgfw.efi) replaced with a malicious one,\u201d\u00a0Kasperksy researchers revealed\u00a0today.\n\n\u201cThis method of infection allowed the attackers to install a bootkit without the need to bypass firmware security checks. UEFI infections are very rare and generally hard to execute, and they stand out due to their evasiveness and persistence.\u201d\n\nUEFI\u00a0(Unified Extensible Firmware Interface) firmware allows for highly persistent bootkit malware as it\u2019s\u00a0installed\u00a0within SPI flash storage soldered to\u00a0computers\u2019\u00a0motherboard making it impossible to get rid of via hard drive replacement or even\u00a0OS re-installation.\n\nBootkits are malicious code planted in the firmware invisible to security solutions within the operating system since it\u2019s designed to\u00a0load\u00a0before everything else, in the initial stage of a device\u2019s booting sequence.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nThey provide attackers with control over an operating systems\u2019 boot process and make it possible to sabotage OS\u00a0defenses bypassing the\u00a0Secure Boot mechanism depending on the system\u2019s boot security mode (enabling \u201cfull boot\u201d or \u201cthorough boot\u201d mod would block the malware as the NSA explains).\n\nPublicly documented attacks and malware using bootkits in the wild are extremely rare \u2014 Lojax\u00a0used by the Russian-backed APT28 hacker group, MosaicRegressor\u00a0was deployed by Chinese-speaking hackers, TrickBot\u2019s TrickBoot module, and Moriya\u00a0which Chinese-speaking threat actors likely used for espionage since 2018.\n\n\u201cWhile in this case the attackers did not infect the UEFI firmware itself, but its next boot stage, the attack was particularly stealthy, as the malicious module was installed on a separate partition and could control the boot process of the infected machine,\u201d the researchers added.\n\nOlder computers that don\u2019t come with UEFI support were infected using a similar tactic, through the MBR (Master Boot Record) with a bootkit first detected in 2014.\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Advanced obfuscation and anti-analysis\u00a0measuresFor other malware samples used in the attacks analyzed by Kaspersky, the spyware\u2019s developers also used four layers of obfuscation and anti-analysis measures designed to make FinFisher one of the \u201chardest-to-detect spywares to date.\u201d\n\nTheir efforts were highly effective since the malware samples could evade almost any detection attempt and were virtually impossible to analyze (every sample spotted by Kaspersky required \u201coverwhelming\u201d amounts of work to unscramble).\n\n\u201cThe amount of work put into making FinFisher not accessible to security researchers is particularly worrying and somewhat impress[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.140585Z"}