Skip to main content

This malware infects your motherboard and is almost impossible to remove

Researchers have discovered malware that has been secretly infecting systems featuring Asus and Gigabyte motherboards for at least six years.

Since 2016, Chinese-speaking hackers have been infiltrating machines with the CosmicStrand malware, according to a report from Bleeping Computer.

A digital encrypted lock with data multilayers.
Getty Images

Notably, once the malicious code has been distributed, it remains largely undetected within the firmware images for certain motherboards. This particular method of targeting firmware images is classified as a Unified Extensible Firmware Interface (UEFI) rootkit.

The strain was named CosmicStrand by researchers working for cybersecurity firm Kaspersky. However, a previous version of the malware — dubbed Spy Shadow Trojan — was initially uncovered by analysts at Qihoo360.

For reference, UEFI is an important application that attaches an operating system with the firmware of the hardware itself. As such, UEFI code is what runs when a computer initially starts up, even before any security measures of the system.

As a result, malware that has been placed in the UEFI firmware image is extremely effective in evading detection measures. More worryingly, however, is the fact that the malware can’t technically be removed by operating a clean reinstall of the operating system. You can’t even get rid of it by replacing the storage drive.

“This driver was modified so as to intercept the boot sequence and introduce malicious logic to it,” said Mark Lechtik, who previously worked as a Kaspersky reverse engineer.

Kaspersky said it found that the CosmicStrand UEFI rootkit was discovered within the firmware images of Gigabyte or Asus motherboards utilizing the H81 chipset, which is associated with hardware sold between 2013 to 2015.

Computer motherboard stock photo

CosmicStrand victims were private individuals located within China, Iran, Vietnam, and Russia, and thus links to a nation state, organization, or industry could not be established. That said, researchers confirmed a CosmicStrand link to a Chinese-speaking threat actor due to code patterns that made an appearance in a separate cryptomining botnet.

Kaspersky stressed that the CosmicStrand UEFI firmware rootkit can more or less remain on an infected system forever.

UEFI malware was first reported on in 2018 by another online security company, ESET. Known as LoJax, it was used by Russian hackers who belonged to the APT28 group. Since then, the amount of UEFI-based rootkits infecting systems has steadily increased, which includes ESPecter — a kit that is said to have been deployed for espionage purposes since 2012.

Elsewhere, security analysts said it detected “the most advanced” UEFI firmware earlier this year in the form of MoonBounce.

It’s been a busy year for groups and hackers involved in the malware community. Most recently, threat actors have managed to use Microsoft Calculator to distribute malicious code, while Microsoft itself launched a new initiative where it offers businesses access to its internal security services.

Editors' Recommendations

Zak Islam
Computing Writer
Zak Islam was a freelance writer at Digital Trends covering the latest news in the technology world, particularly the…
This screwless motherboard will make GPU upgrades easier than ever
The Gigabyte EZ Latch Plus motherboard on a white background.

The DIY home-built PC crowd will be delighted to learn that GPU upgrades just became effortless. The Gigabyte X670 EZ-Latch Plus motherboard is a new screwless and latchless system for easy GPU and SSD swaps.

Tom's Hardware noticed two new Gigabyte motherboards surface on Twitter, a PCIe EZ-Latch Plus and an M.2 EZ-Latch Plus. Both are built with the upcoming Ryzen 7000-series processors with Zen 4 architecture in mind.

Read more
This dangerous Mac malware can infiltrate your entire system
A depiction of a hacker breaking into a system via the use of code.

A newly uncovered malware designed to target Macs has been effective in obtaining access to systems and stealing sensitive data.

The discovery was detailed by internet security company ESET, which named the malware CloudMensis because of its reliance on cloud storage services.

Read more
Oh great, new malware lets hackers hijack your Wi-Fi router
The Linksys Hydra 6 dual-band mesh WiFi 6 router.

As if you didn't already have enough to worry about, a new report finds hackers are targeting home Wi-Fi routers to gain access to all your connected devices.

The report comes from Black Lotus Lab, a security division of Lumen Technologies. The report details several observed real-world attacks on small home/home office (SOHO) routers since 2020 when millions of people began working from home at the start of the COVID 19 pandemic.

Read more