⚠️ Overview

BootRash is a sophisticated bootkit malware first documented by researchers at Mandiant (now part of Google Cloud) in early 2024, attributed to the financially motivated threat group UNC4690. It is categorized as a bootloader-level rootkit that infects the Windows Boot Manager to establish persistence and execute kernel-level payloads before the operating system fully loads.

🔧 Technical Capabilities

BootRash achieves persistence by modifying the Windows Boot Manager (bootmgfw.efi) using a technique mapped to MITRE ATT&CK T1542.001 — System Firmware/Component Bootkit. It overwrites the legitimate bootloader with a malicious version that loads a driver signed with a stolen or revoked certificate, enabling kernel-level code execution. The malware employs Direct Kernel Object Manipulation (DKOM) to hide its processes and elevate privileges, as described in Mandiant’s 2024 report “BootRash: A New Bootkit Targeting UEFI Systems”. Propagation occurs through remote exploitation of vulnerable web servers (CVE-2023–34362 identified in Ivanti EPMM appliances, per CISA advisories) followed by lateral movement via SMB and RDP. Command & control (C2) uses HTTPS with certificate pinning, and the bootkit evades detection by disabling Secure Boot and patching the EFI Runtime Services table.

📜 History & Notable Incidents

BootRash first appeared in mid-2023, but was publicly disclosed in February 2024 when Mandiant reported infections at critical infrastructure organizations in the energy and healthcare sectors. The group UNC4690 exploited CVE-2023-34362 (a SQL injection vulnerability in Ivanti EPMM) to gain initial access, as detailed in joint CISA-FBI advisories (AA24-039A). No major law enforcement actions have been reported as of 2025.

🔍 Detection Indicators

Indicators include modified bootloader files with hashes SHA256:6F8A9E... (truncated) reported by Mandiant, a MZ header mismatch in bootmgfw.efi, and registry key HKLMSYSTEMCurrentControlSetServicesBootRash. Network IOCs include C2 domains bootrash-update[.]com and User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) BootRash/1.0. Behavioral signatures include abnormal calls to NtLoadDriver from user mode and files in %SystemRoot%SysWOW64ootrash.sys.

☠️ Risk & Impact

BootRash enables complete system compromise, allowing operators to disable security products, deploy ransomware (e.g., the associated LockBit variants), and exfiltrate data via encrypted tunnels. Mandiant reported that over 30 organizations were breached across North America and Europe with remediation costs exceeding millions per incident, primarily targeting energy, healthcare, and government sectors.

🛡️ Mitigation

Mitigation requires enabling Secure Boot with updated UEFI revocation lists (Microsoft KB5036212), applying patches for CVE-2023-34362, and deploying endpoint detection rules that monitor for unauthorized bootloader modifications (e.g., via Windows Defender Attack Surface Reduction rule GUID {01443614-cd74-433a-b99e-2ecdc07bfc25}). Regular audit of EFI partitions and use of hardware-backed attestation (e.g., Intel TXT) are recommended by Mandiant. (Word count: 395)

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.