Skip to main content

This malware infects your motherboard and is almost impossible to remove

Researchers have discovered malware that has been secretly infecting systems featuring Asus and Gigabyte motherboards for at least six years.

Since 2016, Chinese-speaking hackers have been infiltrating machines with the CosmicStrand malware, according to a report from Bleeping Computer.

A digital encrypted lock with data multilayers.
Getty Images

Notably, once the malicious code has been distributed, it remains largely undetected within the firmware images for certain motherboards. This particular method of targeting firmware images is classified as a Unified Extensible Firmware Interface (UEFI) rootkit.

The strain was named CosmicStrand by researchers working for cybersecurity firm Kaspersky. However, a previous version of the malware — dubbed Spy Shadow Trojan — was initially uncovered by analysts at Qihoo360.

For reference, UEFI is an important application that attaches an operating system with the firmware of the hardware itself. As such, UEFI code is what runs when a computer initially starts up, even before any security measures of the system.

As a result, malware that has been placed in the UEFI firmware image is extremely effective in evading detection measures. More worryingly, however, is the fact that the malware can’t technically be removed by operating a clean reinstall of the operating system. You can’t even get rid of it by replacing the storage drive.

“This driver was modified so as to intercept the boot sequence and introduce malicious logic to it,” said Mark Lechtik, who previously worked as a Kaspersky reverse engineer.

Kaspersky said it found that the CosmicStrand UEFI rootkit was discovered within the firmware images of Gigabyte or Asus motherboards utilizing the H81 chipset, which is associated with hardware sold between 2013 to 2015.

Computer motherboard stock photo

CosmicStrand victims were private individuals located within China, Iran, Vietnam, and Russia, and thus links to a nation state, organization, or industry could not be established. That said, researchers confirmed a CosmicStrand link to a Chinese-speaking threat actor due to code patterns that made an appearance in a separate cryptomining botnet.

Kaspersky stressed that the CosmicStrand UEFI firmware rootkit can more or less remain on an infected system forever.

UEFI malware was first reported on in 2018 by another online security company, ESET. Known as LoJax, it was used by Russian hackers who belonged to the APT28 group. Since then, the amount of UEFI-based rootkits infecting systems has steadily increased, which includes ESPecter — a kit that is said to have been deployed for espionage purposes since 2012.

Elsewhere, security analysts said it detected “the most advanced” UEFI firmware earlier this year in the form of MoonBounce.

It’s been a busy year for groups and hackers involved in the malware community. Most recently, threat actors have managed to use Microsoft Calculator to distribute malicious code, while Microsoft itself launched a new initiative where it offers businesses access to its internal security services.

Editors' Recommendations

Zak Islam
Former Digital Trends Contributor
Zak Islam was a freelance writer at Digital Trends covering the latest news in the technology world, particularly the…
In the age of ChatGPT, Macs are under malware assault
A person using a laptop with a set of code seen on the display.

It's common knowledge -- Macs are less prone to malware than their Windows counterparts. That still holds true today, but the rise of ChatGPT and other AI tools is challenging the status quo, with even the FBI warning of its far-reaching implications for cybersecurity.

That may be why software developer Macpaw launched its own cybersecurity division -- dubbed Moonlock -- specifically to fight Mac malware. We spoke to Oleg Stukalenko, Lead Product Manager at Moonlock, to find out whether Mac malware is on the rise, and if ChatGPT could give hackers a massive advantage over everyday users.
State-sponsored attacks

Read more
If you have a Gigabyte motherboard, your PC might stealthily download malware
A Gigabyte Aorus Extreme motherboard.

Yet another motherboard manufacturer seems to be in trouble -- or rather, the people who own those motherboards might be. According to security researchers, countless Gigabyte boards might be vulnerable to dangerous cyberattacks.

If you want to be extra safe, there are a couple of things you can do to protect your PC. Here's what we know.

Read more
Hackers are using a devious new trick to infect your devices
A person using a laptop with a set of code seen on the display.

Hackers have long used lookalike domain names to trick people into visiting malicious websites, but now the threat posed by this tactic could be about to ramp up significantly. That’s because two new domain name extensions have been approved which could lead to an epidemic of phishing attempts.

The two new top-level domains (TLDs) that are causing such consternation are the .zip and .mov extensions. They’ve just been introduced by Google alongside the .dad, .esq, .prof, .phd, .nexus, .foo names.

Read more