{"id":14092,"date":"2020-06-25T21:17:28","date_gmt":"2020-06-25T18:17:28","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=14092"},"modified":"2026-03-27T19:16:49","modified_gmt":"2026-03-27T16:16:49","slug":"no-longer-on-lockdown-rovnix-bootkit-returns-with-new-features","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/no-longer-on-lockdown-rovnix-bootkit-returns-with-new-features\/","title":{"rendered":"No longer on lockdown: Rovnix bootkit returns with new features"},"content":{"rendered":"\n

Kaspersky researchers saw the return of the well-known Rovinx bootkit \u2013 a malicious program created to load and protect malware from detection \u2013 in a campaign that exploited the pandemic. Upgraded and featuring an unusual loader, the bootkit delivered a backdoor with Trojan-spyware capabilities to victims\u2019 computers.<\/strong><\/p>\n\n\n\n

The Rovnix bootkit was very popular until its source code was leaked back in 2013, making it available for analysis by all security vendors and other interested parties. However, in mid-April 2020, Kaspersky\u2019s threat monitoring systems detected malicious files containing the famous bootkit. It was being distributed under the name “on the new initiative of the World Bank in connection with the coronavirus pandemic” in Russian, which contained the well-known threat.<\/p>\n\n\n\n

The bootkit featured a number of improvements such as a User Account Control (UAC) bypass mechanism, elevation of privileges on a device, and a loader that isn\u2019t usually associated with this specific bootkit. The analysis of detected files showed that the payload was in fact a backdoor with Trojan-Spy elements, meaning that once installed on the infected device, the attacker would have access to the device and could also collect various types of information.<\/p>\n\n\n\n

The bootkit was distributed via the file “on the new initiative of the World Bank in connection with the coronavirus pandemic.exe” \u2013 a self-extracting archive that serves up a doc file and an executable malicious file. To make it even more convincing, the document contained information about a new initiative from the World Bank, and real individuals related to the organization were cited as authors in the metadata. However, once opened the file would load the bootkit and start the infection process.<\/p>\n\n\n\n

 \u201cThis example shows two things. Firstly, that we can never be sure that an old threat will not return, and secondly, cybercriminals really do adapt quickly \u2013 they are more agile in the tools they use and do not restrain from jumping on \u2018hot\u2019 topics. Our analysis shows that once the source code of a threat goes public, it can result in surprises, as in the case with Rovnix. Freed from the need to develop their own protection-bypassing tools from scratch, cybercriminals can pay more attention to the capabilities of their own malware and add extra \u2018goodies\u2019 to the source code\u201d \u2013 comments Alexander Eremin, security analyst at Kaspersky.<\/em><\/p>\n\n\n\n

To protect yourself from threats such as Rovnix, Kaspersky recommends users:<\/strong><\/p>\n\n\n\n