Bootkit.

A bootkit is a specialized rootkit that compromises early boot components — the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware — so it executes before the operating system and its security tools. From that vantage point it can disable defences, hook the kernel, and survive OS reinstalls. Legacy MBR bootkits (TDL4/Alureon, Rovnix, Petya's disk-encrypting loader) gave way to UEFI-era implants that target NVRAM variables and the EFI System Partition.

Where a bootkit lives in the boot chain

flowchart LR
  A[Power on] --> B[UEFI firmware<br/>SPI flash]
  B --> C[Secure Boot<br/>verifies signatures]
  C --> D[Boot manager<br/>bootmgfw.efi]
  D --> E[OS loader / kernel]
  B -. firmware implant<br/>MoonBounce/LoJax .-> B
  C -. exploit CVE-2022-21894<br/>bypass Secure Boot .-> D
  D -. malicious .efi on<br/>EFI System Partition .-> D
  E --> F[OS + security tools<br/>load last, already subverted]

Named examples

LoJax (ESET, 2018) was the first UEFI firmware rootkit seen in the wild, attributed to Sednit/APT28. MoonBounce (2022) hid in SPI flash. BlackLotus (2023) became the first bootkit to defeat UEFI Secure Boot on fully-patched Windows 11: it "brings its own" vulnerable-but-signed boot binaries to exploit CVE-2022-21894 ("Baton Drop"), then disables HVCI, BitLocker and Defender. Because the vulnerable binaries stayed validly signed, Microsoft's fix required revocation — a code-integrity policy in the May 2023 updates plus DBX additions (and later KB5025885 guidance), which risked bricking dual-boot media if applied carelessly.

Detection and mitigation

Enable UEFI Secure Boot with current DBX revocation lists, apply firmware/BIOS passwords, disable the legacy CSM, and use TPM-backed measured boot with remote attestation. Detection typically needs offline forensic imaging of the SPI flash and ESP, since a live, already-subverted OS cannot be trusted to report its own boot chain.