A rootkit is malware designed to hide itself and other malicious activity deep in the operating system, often with the highest privileges, so the attacker can keep control unnoticed.
How a rootkit works
The name comes from Unix: “root” is the administrator account, and a “kit” is a set of tools. A rootkit intercepts system functions so that files, processes, registry keys and network connections of the attacker are invisible to the user and to security tools. By location:
- user-mode rootkits modify applications and system libraries;
- kernel-mode rootkits load as drivers and change the core of the OS;
- bootkits infect the boot process and start before the operating system;
- firmware rootkits sit in UEFI or device firmware and survive reinstalling the OS and even replacing the disk.
Why rootkits matter for security
Rootkits provide stealthy, long-term persistence and are favoured by APT groups. To install one the attacker usually needs admin rights, obtained through privilege escalation. Notable cases: the copy protection that Sony BMG shipped on music CDs in 2005 behaved like a rootkit; LoJax, found by ESET in 2018, was the first UEFI rootkit seen in the wild; the BlackLotus bootkit sold in 2023 could bypass Secure Boot on fully updated Windows 11 systems. Attackers also abuse signed but vulnerable drivers (BYOVD) to get kernel access and switch off EDR.
How to defend
- Enable Secure Boot, TPM-based measured boot and memory integrity (HVCI) on Windows.
- Update firmware and block known vulnerable drivers.
- Scan from outside the infected system (boot media) when a rootkit is suspected.
- After a confirmed rootkit infection, rebuild the system from clean media and reflash firmware if needed.
