A bootkit is malware that infects the boot process of a computer – the boot sector or UEFI boot components – so that it starts before the operating system and can control it from below.
How bootkits work
When a computer starts, firmware loads a bootloader, which in turn loads the operating system kernel. A bootkit inserts itself into this chain. Older bootkits overwrote the Master Boot Record (MBR) or Volume Boot Record on the disk; modern ones target UEFI – either boot files on the EFI System Partition or, in rarer cases, the firmware itself. Because the bootkit runs first, it can patch the kernel in memory, disable security features and load a rootkit that hides files, processes and network traffic. MITRE ATT&CK lists the technique as Pre-OS Boot: Bootkit (T1542.003).
Why bootkits matter
Bootkits are extremely stealthy and persistent: antivirus running inside Windows cannot see what happened before it started, and some bootkits survive reinstalling the operating system. Examples:
- TDL4 (Alureon) (around 2010) – a widespread MBR bootkit used to build a botnet.
- Petya (2016) – ransomware that replaced the MBR and encrypted the disk’s file table.
- ESPecter (2021) – a bootkit modifying the Windows Boot Manager on the EFI System Partition.
- BlackLotus (2023) – the first publicly known UEFI bootkit able to bypass Secure Boot on fully updated Windows 11 systems; it was sold on criminal forums.
How to protect against bootkits
- Enable UEFI Secure Boot and keep firmware, bootloaders and the Secure Boot revocation list (DBX) up to date.
- Use a TPM with measured boot to detect changes to boot components.
- Protect firmware settings with a password and restrict administrator rights.
- If a bootkit is suspected, rebuild from trusted media and, for firmware infections, reflash or replace the hardware.
