CyberGlossary

Malware

Bootkit

Also known as: Boot rootkit, MBR rootkit

Definition

Malware that infects the boot process — MBR, VBR, or UEFI — to load before the operating system and obtain persistent, privileged control.

A bootkit is a specialized rootkit that compromises early boot components such as the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware. Because it executes before the OS and security tools, it can disable defences, hook kernel code, and survive OS reinstalls. Modern bootkits target UEFI variables and the EFI System Partition. Detection requires firmware integrity checks, measured/Secure Boot with TPM attestation, and offline forensic imaging of boot media. Mitigations include enabling UEFI Secure Boot with current revocation lists, BIOS/firmware passwords, disabling legacy CSM boot, and full-disk encryption to detect tampering with the boot chain.

Examples

  • BlackLotus, a UEFI bootkit able to bypass Secure Boot on patched systems.
  • MoonBounce, an APT-grade UEFI firmware implant.

Related terms