Friday, May 9, 2025
HomeMalwareChinese APT Hackers Deploys MoonBounce Implant In UEFI Firmware

Chinese APT Hackers Deploys MoonBounce Implant In UEFI Firmware

Published on

SIEM as a Service

Follow Us on Google News

Kaspersky Lab experts have recently discovered a security vulnerability in UEFI firmware, and this vulnerability was detected while studying the Firmware Scanner logs at the end of 2021.

During the further analysis, they found that the threat actors had modified one of the components in the firmware image that enabled the attackers to change the execution chain in UEFI and then inject the malicious code that runs at the startup of the machine.

On the victim’s network, the components of the modified firmware and other artifacts of malicious activity were analyzed, and it’s been detected that the malicious code which was implanted into the UEFI firmware was dubbed as “MoonBounce.”

- Advertisement - Google News

Other Malware and Implants That are Under The Radar

Here we have mentioned all the other malware, stagers, and post-exploitation malware implants that were used by the Chinese-speaking attackers:-

  • Microcin: It’s a backdoor that is used by the operators of the SixLittleMonkeys group.
  • Mimikat_ssp: It’s a publicly available post-exploitation tool that is used to dump the credentials and security secrets from exe.
  • Go implant: It’s a formerly unknown backdoor that is used to contact a C2 server by using the RESTful API.

Moreover, this MoonBounce implant targets the organizations that are in command of several corporations dealing with transport technology. In short, their target is the transport sector.

Feature of MoonBounce

MoonBounce offers a distinctive feature that enables the MoonBounce to remain un-hidden in the ESP (EFI System Partition), and it’s the section where the UEFI code is located; but, in this situation with an active implant, it is immediately embedded in the SPI flash memory, that is located on the motherboard.

Here, the malware can be launched in both situations, which implies:-

  • After reinstalling the operating system.
  • After formatting or replacing the hard drive. 

While on the infected device until the SPI memory is flashed, which is a very complicated process until the motherboard is replaced, the bootkit will remain over there.

The MoonBounce is the third UEFI bootkit that was capable of infecting SPI memory, but, apart from this, the previous two cases are:-

  • LoJax malware
  • MosaicRegressor malware

Operators of MoonBounce

The MoonBounce was used as a form to maintain access to the infected host and then in the second stage of the attack deploy the malware.

While it’s been confirmed by the experts that during their analysis they found MoonBounce was deployed once so far on the network of an unnamed transport company.

Since MoonBounce and other malware found on the victim’s network constantly contacted the server infrastructure, from where the APT41 group command all its instructions.

So, they have speculated that the operators behind the MoonBounce malware could be a Chinese cyber-espionage group that is dubbed as “APT41.” What is not clear till now is the installation procedure of MoonBounce.

But, still, cybersecurity researchers are analyzing the MoonBounce closely to get all the key details.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit Host Header Injection to Breach Web Applications

Cybersecurity researchers have reported a significant rise in web breaches triggered by a lesser-known...

Hackers Exploit Windows Remote Management to Evade Detection in AD Networks

A new wave of cyberattacks is targeting Active Directory (AD) environments by abusing Windows...

Researchers Uncover Remote Code Execution Flaw in macOS – CVE-2024-44236

Security researchers Nikolai Skliarenko and Yazhi Wang of Trend Micro’s Research Team have disclosed...

Apache ActiveMQ Vulnerability Allows Attackers to Induce DoS Condition

Critical vulnerability in Apache ActiveMQ (CVE-2024-XXXX) exposes brokers to denial-of-service (DoS) attacks by allowing...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Russian COLDRIVER Hackers Deploy LOSTKEYS Malware to Steal Sensitive Information

The Google Threat Intelligence Group (GTIG) has uncovered a sophisticated new malware dubbed LOSTKEYS,...

Lampion Banking Malware Uses ClickFix Lures to Steal Banking Credentials

Unit 42 researchers at Palo Alto Networks, a highly targeted malicious campaign orchestrated by...

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...