This malware, named Bootkitty, introduces a new method of attacking Linux, which has traditionally been considered safer from such stealthy threats compared to Windows.
Bootkits are highly dangerous because they infect a computer’s boot process, loading before the operating system starts.
This allows them to take deep control of a system while avoiding detection by traditional security tools.
Bootkitty specifically targets certain versions of Ubuntu Linux by bypassing critical security checks during system boot.
How Bootkitty Works
ESET discovered Bootkitty in November 2024 when a suspicious file, bootkit.efi, was uploaded to VirusTotal. The malware uses advanced techniques to bypass kernel signature verification and inject malicious components during the system boot process.
It relies on a self-signed certificate, meaning it won’t function on systems with Secure Boot enabled. The malware hooks into UEFI security protocols and GRUB bootloader functions, disabling key security checks and loading malicious modules into the Linux kernel. Bootkitty also forces a malicious library to load into system processes upon startup.
However, the malware is not without flaws. It only works on specific GRUB and kernel versions, which limits its effectiveness. It can cause system crashes due to compatibility issues.
During their investigation, researchers also found another suspicious file, BCDropper, likely associated with Bootkitty. BCDropper installs a rootkit named BCObserver, which provides stealthy control by hiding files, processes, and open ports on the infected system.
Growing Threat to Linux
Although Bootkitty is not yet fully developed or actively deployed in real-world attacks, its discovery is concerning. It signals that cybercriminals are increasingly targeting Linux as more businesses rely on it for critical operations.
To help organizations defend against Bootkitty, ESET has published indicators of compromise (IoCs) on GitHub.
Recommendations for Protection
- Enable Secure Boot: Since Bootkitty cannot operate with Secure Boot enabled, this is a crucial defense.
- Update Security Tools: Keeping antivirus and other security software up to date can help detect and block new threats.
This discovery underscores the growing sophistication of Linux-targeted malware and the need for robust security practices to safeguard critical systems.
