{
  "family": "backboot",
  "sample_count": 22,
  "category": "advanced_threat",
  "description": "Rootkit:Win32/Backboot is an extremely dangerous class of malware designed to fundamentally subvert the Windows operating system at its lowest levels. By infecting the Master Boot Record (MBR) or Volume Boot Record (VBR), Backboot guarantees it executes *before* Windows itself, granting it absolute control over the system and the ability to hide entirely from standard security software.<br><br><b>Understanding Backboot (Bootkits)</b><br>To an end-user, a Backboot infection is completely invisible; the system boots normally. For a threat hunter, a bootkit is a nightmare scenario. Because it loads before the OS kernel, it can patch kernel memory in real-time, intercepting API calls made by antivirus software and returning falsified data. This allows it to completely hide its files, registry keys, and network connections from the OS, effectively blinding EDR solutions.<br><br><b>Execution and Kernel Subversion</b><br>Backboot is typically deployed as a secondary payload by a sophisticated dropper that has already gained Administrator or SYSTEM privileges. Upon execution, the malware overwrites the physical sectors of the hard drive containing the MBR/VBR (`T1542.003`). When the computer reboots, the BIOS/UEFI loads the malicious bootloader first. This bootloader patches the Windows kernel (`ntoskrnl.exe`) in memory as it loads (`T1014`), hooking critical functions (like `ZwQueryDirectoryFile` or `ZwEnumerateKey`). This allows the bootkit to create a hidden Virtual File System (VFS) to store its modules and to inject payloads directly into user-mode processes without leaving traces on the disk.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total and undetectable system compromise. Detection requires advanced techniques. EDR platforms may detect the initial attempt to write raw data to `\\\\.\\PhysicalDrive0`. However, post-infection detection requires offline analysis. Booting from a clean, live USB (like WinPE) and comparing the MBR hash against a known good baseline is the definitive way to detect a bootkit, as the malware cannot intercept API calls if its host OS isn't running.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1542.003",
    "T1014",
    "T1055",
    "T1561.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Pre-OS Boot: Bootkit",
      "tactic": "Persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1561.002",
      "name": "Disk Wipe: Disk Structure Wipe",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the machine from the network; the attacker has total control and is completely invisible to standard monitoring.",
    "Do NOT attempt to use standard antivirus to clean the machine; the bootkit will simply lie to the AV scanner, reporting the system as clean.",
    "Capture a full physical memory image (RAM dump) for forensic analysis of the kernel hooks and the decrypted payload.",
    "The only guaranteed remediation for a bootkit is to completely wipe the hard drive (including rebuilding the MBR and partition tables) and perform a clean OS install."
  ],
  "what_to_avoid": [
    "Do not trust any data or scan results generated from the infected operating system.",
    "Avoid simply reinstalling Windows over the existing partition; the bootkit resides outside the file system and will survive a standard reinstall."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}