BootKitty

BootKitty is a bootkit ELF malware that hijacks the UEFI on Linux systems by using a malicious EFI booter and is the first ever bootkit for Linux systems. It was also tracked as the malware family IranuKit.^[1]

When the ELF program of BootKitty is ran, it attempts to disable the kernel signing feature on a Linux system and to preload two loaders, one of which is ran by the Linux kernel on boot, using the Linux init system.^[2] This allows BootKitty to persist beyond system reboots, reinstallations, and hard drive replacements.^[3] BootKitty primarily uses the exploit LogoFAIL in order to gain firmware-level persistence.^[4] Using LogoFAIL, BootKitty embed shellcode into two BMP image files during boot to bypass Secure Boot protections by injecting rogue certifications into the MokList variant.^[5] When it was detected in 2024, the EFI file used was self-signed though this normally wouldn't allow it to be ran on systems with UEFI protections on it bypasses these protections is capable of replacing the boot loader and of patching the kernel ahead of its execution.^[6] BootKitty is designed mainly to target Ubuntu systems and related Linux distributions.^[7] Not all devices are considered susceptible to the exploits this malware uses, the BMP image file and assembler code is specifically made for Lenovo devices and can only work on certain GNU GRUB and Linux kernel versions.^[8]

The malware has been compared to the BlackLotus malware by malware and security researchers ^[9]

After BootKitty began gaining notoriety among security researchers, multiple university students from South Korea claimed responsibility for its creation as a proof-of-concept accidentally going public issuing a statement of no ill intent.^[10]