{"id":35524,"date":"2022-08-02T16:49:53","date_gmt":"2022-08-02T13:49:53","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=35524"},"modified":"2026-03-28T01:26:30","modified_gmt":"2026-03-27T22:26:30","slug":"cosmicstrand-sophisticated-firmware-rootkit-allows-durable-persistence","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/cosmicstrand-sophisticated-firmware-rootkit-allows-durable-persistence\/","title":{"rendered":"CosmicStrand: sophisticated firmware rootkit allows durable persistence"},"content":{"rendered":"\n

Kaspersky\u2019s researchers have uncovered a rootkit developed by an advanced persistent threat (APT) actor that<\/strong> stays on the victim\u2019s machine even if the operating system is rebooted or Windows is reinstalled \u2013 making it very dangerous in the long run. Dubbed \u201cCosmicStrand,\u201d this UEFI firmware rootkit was used majorly to attack private individuals in <\/strong>China, with rare cases in Vietnam, Iran and Russia.<\/strong><\/strong><\/p>\n\n\n\n

The UEFI firmware is a critical component in the vast majority of hardware. Its code is responsible for booting up a device, launching the software component that loads the operating system. If the UEFI firmware is somehow modified to contain malicious code that code will be launched before the operating system, making its activity potentially invisible to security solutions and to the operating system\u2019s defenses. This, and the fact that the firmware resides on a chip separate from the hard drive, makes attacks against UEFI firmware exceptionally evasive and persistent \u2013 because regardless of how many times the operating system is reinstalled, the malware will stay on the device.<\/p>\n\n\n\n

CosmicStrand, the recent UEFI firmware discovery made by Kaspersky\u2019s researchers, is attributed to a previously unknown Chinese-speaking actor. While the end goal pursued by the attackers remains unknown, it was observed that affected victims were individual users \u2013 as opposed to corporate computers. <\/p>\n\n\n\n

All of the attacked machines were Windows-based: every time a computer rebooted, a bit of malicious code would be executed after Windows started. Its purpose was to connect to a C2 (command-and-control) server and download an additional malicious executable.<\/p>\n\n\n\n

The researchers could not determine how the rootkit ended up on the infected machines in the first place. Still, unconfirmed accounts discovered online indicate that some users have received compromised devices while ordering hardware components online.<\/p>\n\n\n\n

The most striking aspect of CosmicStrand is that the UEFI implant seems to have been used in the wild since the end of 2016 \u2013 long before UEFI attacks started being publicly described. <\/p>\n\n\n\n

\u201cDespite being recently discovered, the CosmicStrand UEFI firmware rootkit seems to have been being deployed for quite a long time. This indicates that some threat actors have had very advanced capabilities that they\u2019ve managed to keep under the radar since 2017. We are left to wonder what new tools they have created in the meantime that we have yet to discover.<\/em>\u201d <\/em>comments Ivan Kwiatkowski, senior security researcher at Global Research and Analysis Team (GReAT) at Kaspersky.<\/p>\n\n\n\n

A more detailed analysis of the CosmicStrand framework and its components is presented on Securelist.<\/p>\n\n\n\n

In order to stay protected from threats such as CosmicStrand, Kaspersky recommends:<\/strong><\/p>\n\n\n\n