BIOS Rootkit.

A BIOS rootkit modifies the legacy Basic Input/Output System firmware — the pre-UEFI code that ran on x86 systems — so it gains control during early boot, before any OS protection loads. From there it can disable security tooling, hide other malware, and survive OS reinstalls and even disk replacement, because it lives in the motherboard's SPI flash chip. Mebromi (2011) was the first BIOS rootkit seen in the wild, targeting Award BIOS to re-drop malware after cleanup.

The technique migrated to UEFI implants as BIOS disappeared. In September 2018 ESET disclosed LoJax, the first UEFI rootkit found in the wild, used by the Russia-linked Sednit group (APT28/Fancy Bear); it repurposed the Absolute LoJack/Computrace anti-theft agent and reflashed the SPI flash of targets in the Balkans and Central/Eastern Europe. In 2022 Kaspersky found MoonBounce (attributed to APT41) hidden in flash. In March 2023 ESET analysed BlackLotus, the first in-the-wild UEFI bootkit to bypass Secure Boot on fully patched Windows 11 by exploiting CVE-2022-21894 ("Baton Drop") — the patched-but-unrevoked signed bootloaders let it disable BitLocker, HVCI, and Defender; it sold on forums for around $5,000.

flowchart TD
  A[Attacker flashes SPI/BIOS chip] --> B[Firmware implant persists]
  B --> C[Runs before OS at power-on]
  C --> D[Disables Secure Boot / AV / BitLocker]
  D --> E[Loads kernel payload]
  E --> F[Re-infects OS after reinstall]
  G[Defences: Secure Boot + dbx revocation,<br/>Boot Guard, SPI write-protect,<br/>measured boot / TPM attestation] -.blocks.-> C

Defences include UEFI Secure Boot with up-to-date dbx revocation lists, Intel Boot Guard, vendor SPI flash write-protection, signed firmware updates, and measured boot with TPM-based integrity attestation, backed by supply-chain and physical controls.