Bootkit.

What Is a Bootkit?

A bootkit is malware that runs while a computer starts, before the operating system has loaded. MITRE ATT&CK tracks bootkits as sub-technique T1542.003, under the persistence and stealth tactics. Because the code runs below the operating system, security tools inside it may not see it.

On older BIOS machines, MITRE says a bootkit may change the Master Boot Record (MBR) or the Volume Boot Record (VBR). On UEFI machines, it may instead add or change files in the EFI system partition (ESP). That partition holds the files a UEFI machine uses to start the operating system.

What Are UEFI and Firmware?

Firmware is the code stored on the board that starts the hardware. BIOS and UEFI, the Unified Extensible Firmware Interface, are the two common kinds of this firmware on PCs and servers. MITRE describes both as the software interface between the operating system and the hardware.

A bootkit and a firmware implant are close, but they are not the same. A bootkit usually sits on the disk, in the boot sectors or the ESP. A firmware implant changes the firmware itself, which MITRE tracks as System Firmware, T1542.001. MITRE lists LoJax as one example of that technique.

How Does a Bootkit Get In?

Most bootkits need administrator rights first. Microsoft says the use of BlackLotus is “primarily a persistence and defense evasion mechanism”, not a way into a network. Kaspersky says attackers deployed the BlackX bootkit after they had compromised the network and obtained administrator privileges.

Secure Boot is meant to stop untrusted boot code, so bootkits look for ways around it. Microsoft says BlackLotus used CVE-2022-21894, known as Baton Drop, to bypass Windows Secure Boot. Our step-by-step look at the BlackX UEFI bootkit shows the same flaw at work on patched Windows machines.

Where Does Network Boot Fit In?

PXE, the Preboot Execution Environment, lets a machine load its start-up code over the network instead of from a disk. The network code that does this runs inside the firmware, before the operating system. TianoCore’s advisory links it to OS provisioning and recovery.

In October 2026, TianoCore disclosed CVE-2026-97631, a pre-boot flaw in the EDK II PXE driver. An oversized ICMP error message sent to a machine during a network boot can overflow a buffer. The advisory says this can run attacker code before Secure Boot or measured boot has checked any OS component. That is the bootkit’s layer, but the advisory does not describe a bootkit or any persistence.

Why Are Bootkits Hard to Remove?

MITRE notes that bootkits can make full remediation difficult unless defenders suspect one was used. Reinstalling only the operating system can leave the boot files in place. For BlackLotus, Microsoft advises taking the device off the network and reformatting both the OS partition and the EFI partition.

Restoring from a clean backup that includes the EFI partition is the other option Microsoft names. Microsoft also says BlackLotus writes its files to the ESP and locks them, so they cannot be deleted or changed.

How Do You Defend Against Bootkits?

• Keep Secure Boot on, and use a TPM with trusted or measured boot. MITRE lists this as Boot Integrity, mitigation M1046.
• Limit who holds administrator rights, since bootkits usually need them to install. MITRE lists this as Privileged Account Management, M1026.
• Apply BIOS and UEFI updates from your hardware maker. MITRE lists firmware patching under Update Software, M1051.
• Harden Secure Boot as your vendor advises. For BlackLotus, Microsoft says removing the Microsoft 3rd Party UEFI CA, on systems that do not need it, blocks BlackLotus but does not eliminate the vulnerability.
• Turn off network boot on machines that never use it. This last step is our advice.

NIST’s firmware resiliency guide, SP 800-193, groups such controls into three goals: protect, detect and recover. Brandefense Cyber Threat Intelligence helps teams follow new boot and firmware flaws, public exploit code and campaigns such as BlackX.