Researchers have discovered malware that has been secretly infecting systems featuring Asus and Gigabyte motherboards for at least six years.
Since 2016, Chinese-speaking hackers have been infiltrating machines with the CosmicStrand malware, according to a report from Bleeping Computer.
Notably, once the malicious code has been distributed, it remains largely undetected within the firmware images for certain motherboards. This particular method of targeting firmware images is classified as a Unified Extensible Firmware Interface (UEFI) rootkit.
The strain was named CosmicStrand by researchers working for cybersecurity firm Kaspersky. However, a previous version of the malware — dubbed Spy Shadow Trojan — was initially uncovered by analysts at Qihoo360.
For reference, UEFI is an important application that attaches an operating system with the firmware of the hardware itself. As such, UEFI code is what runs when a computer initially starts up, even before any security measures of the system.
As a result, malware that has been placed in the UEFI firmware image is extremely effective in evading detection measures. More worryingly, however, is the fact that the malware can’t technically be removed by operating a clean reinstall of the operating system. You can’t even get rid of it by replacing the storage drive.
“This driver was modified so as to intercept the boot sequence and introduce malicious logic to it,” said Mark Lechtik, who previously worked as a Kaspersky reverse engineer.
Kaspersky said it found that the CosmicStrand UEFI rootkit was discovered within the firmware images of Gigabyte or Asus motherboards utilizing the H81 chipset, which is associated with hardware sold between 2013 to 2015.
CosmicStrand victims were private individuals located within China, Iran, Vietnam, and Russia, and thus links to a nation state, organization, or industry could not be established. That said, researchers confirmed a CosmicStrand link to a Chinese-speaking threat actor due to code patterns that made an appearance in a separate cryptomining botnet.
Kaspersky stressed that the CosmicStrand UEFI firmware rootkit can more or less remain on an infected system forever.
UEFI malware was first reported on in 2018 by another online security company, ESET. Known as LoJax, it was used by Russian hackers who belonged to the APT28 group. Since then, the amount of UEFI-based rootkits infecting systems has steadily increased, which includes ESPecter — a kit that is said to have been deployed for espionage purposes since 2012.
Elsewhere, security analysts said it detected “the most advanced” UEFI firmware earlier this year in the form of MoonBounce.
It’s been a busy year for groups and hackers involved in the malware community. Most recently, threat actors have managed to use Microsoft Calculator to distribute malicious code, while Microsoft itself launched a new initiative where it offers businesses access to its internal security services.
