UEFI Rootkit

A UEFI rootkit lodges itself in the Unified Extensible Firmware Interface — the modern replacement for BIOS — typically in SPI flash modules or boot drivers. It runs before the operating system, so it can disable security controls, modify boot components, and reload other malware after OS reinstalls. Such implants are usually deployed by well-resourced threat actors, often via kernel privileges, physical access, or supply-chain compromise. Defences include enforced Secure Boot, signed firmware updates, measured boot with TPM-based attestation, vendor integrity tools (e.g., CHIPSEC), Boot Guard, BIOS write-protect, and supply-chain integrity controls for firmware updates.