UEFI Firmware Rootkit Dubbed Cosmic Strand Identified
Table of Contents
- Who is Behind the Threat?
- How is the Attack Performed?
- Who is Targeted by the Cosmic Strand Rootkit?
- What are Rootkits all About?
- What Other UEFI Rootkits are on the Digital Security Landscape?
- What is the Nature of the Malware Transmitted by the Server?
- How Many Variations of the Rootkit Exist?
- How can Businesses and Everyday People Protect Their Computers?
- By Steven
- Jul 27, 2022
Digital security experts have identified a new UEFI firmware rootkit. Referred to as Cosmic Strand, the UEFI firmware rootkit poses a significant threat, as detailed below.
Who is Behind the Threat?
Those who have taken a deep dive into Cosmic Strand insist the threat is tied to Chinese hackers. However, digital security specialists have not yet distinguished whether the danger is linked to the Chinese government or parties within the totalitarian nation.
How is the Attack Performed?
The rootkit in question is positioned within the ASUS or Gigabyte motherboards' firmware images. The images pertain to the designs of the H81 chipset. In other words, a susceptibility permits digital miscreants to transmit the rootkit into the firmware image.
The first access vector of infection is a bit shady. Yet, the actions after the compromise that implement alterations to the CSMCORE DXE driver for a code execution redirect to a trap controlled by hackers. This trap is executed during the system's startup, setting the stage for malware deployment in Windows. The overarching aim of the attack is to compromise the operating system loading processes to trigger an implant deployment at the kernel level into Windows machines at the time of booting. This access point spurs shellcode connecting to remote servers that obtain the payload for execution.
Who is Targeted by the Cosmic Strand Rootkit?
These cyber attacks focus on several countries, including Russia, Iran, China, and Vietnam. However, there is no common thread between these victims that links them together, be it industry, niche, etc.
What are Rootkits all About?
Some readers might be unaware as to what, exactly, rootkits do. Rootkits are best described as malware implants that settle within operating systems. Rootkits have become more common than most assume, causing computers to be infected even after the operating system is reinstalled, or the hard drive is replaced. It is interesting to note that Cosmic Strand is just under 97 KB in size.
What Other UEFI Rootkits are on the Digital Security Landscape?
Cosmic Strand is not the only UEFI rootkit posing a threat. Earlier this year, another UEFI rootkit in MoonBounce emerged. MoonBounce was a component of a spying campaign conducted by Winnti, an advanced persistent threat group identified in January of this year.
What is the Nature of the Malware Transmitted by the Server?
The answer to this question is unclear as of the time of this publication. The payload is obtained from update.bokts.com as packets with 528-byte data that is reconfigured and subsequently interpreted as shellcode. Shellcodes secured through the command-and-control server are likely predecessors to PE executables of the aggressors.
How Many Variations of the Rootkit Exist?
Digital security specialists with Kaspersky insist there are at least two versions of the rootkit. However, several other variations of the rootkit likely exist.
How can Businesses and Everyday People Protect Their Computers?
Now is the opportune time to add to your digital defenses. Upgrade your cyber protections against the flurry of online threats, and you'll transition to the next chapter of our tech-centric future without worry.
