First Linux UEFI Bootkit 'Bootkitty' Discovered, Marking New Era in Linux Threats

· 1 min read

article picture

Security researchers at ESET have identified a groundbreaking piece of malware called "Bootkitty" - the first known UEFI bootkit specifically designed to target Linux systems.

The malware was discovered when an unknown UEFI application named "bootkit.efi" was uploaded to VirusTotal. While still in development, this discovery marks a concerning shift in the threat landscape for Linux users.

Bootkitty operates by infecting the system's startup phase, allowing it to gain control before the operating system loads. This enables the malware to hide its presence while maintaining deep access to both the operating system and user applications.

Currently, the bootkit only affects specific Ubuntu distributions and relies on a self-signed security certificate. This means systems with UEFI Secure Boot enabled are protected for now. However, researchers warn that malware authors could overcome these limitations in future versions.

The bootkit contains specialized code to manipulate various components including:

  • UEFI firmware functions
  • Linux kernel operations
  • GRUB boot loader processes

Despite its sophisticated design, analysis shows Bootkitty is still incomplete and contains multiple unfinished features. Researchers also found a related kernel module called BCDropper, designed to load additional malicious code.

While Bootkitty appears to be in proof-of-concept stage, its emergence signals a notable development. UEFI bootkits have historically targeted Windows systems, but Linux's growing popularity now makes it an attractive target for cybercriminals.

The security community advises heightened vigilance as this discovery likely represents the beginning of more sophisticated Linux-focused threats. Organizations relying on Linux infrastructure should review their security measures, particularly around boot process protection.