> ## Content Index > Fetch the complete content index at: https://itsfoss.com/llms.txt > Use this file to discover other available public pages before exploring further. # Bootkitty: The First UEFI Bootkit Built for Linux Appears! - URL: https://itsfoss.com/news/bootkitty-linux/ - Published: 2024-11-28T11:28:52.000Z - Updated: 2024-11-28T11:28:52.000Z - Description: Nothing is bulletproof. However, it is still not a concern for panic. Just follow the best practices, and you should be fine. - Author: Sourav Rudra - Tags: Linux, News, #Import 2025-11-08 21:15 If you own a computer, it is imperative that you take care of its security by investing time and resources in safeguarding it. [Threat actors](https://en.wikipedia.org/wiki/Threat%5Factor?ref=itsfoss.com) across the world are constantly working on undermining the security measures of computers. It doesn't matter whether you are an individual or a big corporation raking in millions in revenue; you should be on guard. There used to be a time when operating systems like Windows and macOS were **the most bountiful targets** for such perpetrators, but they are not the only prey now. Thanks to an increase in both personal and enterprise usage, Linux distributions are slowly but surely becoming the next big thing to crack. And guess what? A new threat called “**Bootkitty**” has recently been [uncovered](https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/?ref=itsfoss.com) that targets UEFI-equipped Linux systems. ## Bootkitty: Should Linux Users Be Worried? ![a screenshot of the ascii text generated by bootkitty](https://itsfoss.com/content/images/2024/11/Bootkitty_a-1.png) Source: [ESET](https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/?ref=itsfoss.com) Known for their cybersecurity expertise, ESET's researchers first stumbled across this on [VirusTotal](https://www.virustotal.com/gui/file/f1f84819bdf395d42c36adb36ded0e7de338e2036e174716b5de71abc56f5d40?ref=itsfoss.com) where it was uploaded anonymously as an unknown [UEFI](https://en.wikipedia.org/wiki/UEFI?ref=itsfoss.com) application named “*bootkit.efi*”. After analyzing it, the ESET team found that it was **a UEFI bootkit for Linux, which targeted specific versions of Ubuntu**. If you didn't know, a [bootkit](https://en.wikipedia.org/wiki/Rootkit?ref=itsfoss.com#bootkit) is a type of rootkit that is specifically designed to infect a computer's boot process. These allow an attacker to carry out a range of malicious actions while staying hidden from conventional malware removal methods. The researchers deduced that Bootkitty's main goal was to: > Disable the kernel’s signature verification feature and to preload two as yet unknown ELF binaries via the Linux init process. As it stands, **Bootkitty can affect UEFI systems with secure boot enabled** only if the attacker has successfully installed malicious certificates, and also in cases where secure boot is not enabled. The researchers found many [artifacts](https://www.sciencedirect.com/topics/computer-science/malware-artifact?ref=itsfoss.com) that aided them in understanding what this bootkit was all about. They found two unused functions that were capable of printing special [strings](https://en.wikipedia.org/wiki/String%5F%28computer%5Fscience%29?ref=itsfoss.com) during execution. The first was the ASCII art you saw above, which led ESET to believe that Bootkitty is what the bootkit is called. ![](https://itsfoss.com/content/images/2024/11/Bootkitty_b.png) ![](https://itsfoss.com/content/images/2024/11/Bootkitty_c.png) Source: [ESET](https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/?ref=itsfoss.com) The second was the printing of a list of potential Bootkitty authors (*redacted by ESET*) and other people related to the malware, with another set of strings being printed out on every boot containing the following text: > Bootkitty's Bootkit > \- Developed By BlackCat ESET clarifies that they don't believe this is related to the notorious [BlackCat](https://en.wikipedia.org/wiki/BlackCat%5F%28cyber%5Fgang%29?ref=itsfoss.com) ransomware group, as that group primarily develops Rust-based malware, while Bootkitty was developed using C. Currently, many in the cybersecurity space consider Bootkitty to be **an initial proof-of-concept bootkit**, with ESET explaining that according to their data, it has not yet been used in the outside world. So, for now, there is no need to panic. 🤓 Nevertheless, **taking some preventative measures will go a long way** in securing your Linux system. You can learn about some of those by reading on. **Don't Miss The Deals** 🕐 [Black Friday Deals for Linux Users — 2024 EditionBlack Friday is here. Don’t miss the deals offering massive discounts!![](https://itsfoss.com/content/images/size/w256h256/2022/12/android-chrome-192x192.png)It's FOSSAnkush Das![](https://itsfoss.com/content/images/2024/11/black-friday-sale.png)](https://itsfoss.com/black-friday-linux-2024/) ## What Steps To Take? For starters, **keep secure boot enabled**, as it is highly unlikely that your system has been affected by the Bootkitty attackers' malicious UEFI certificates. Then comes the most obvious one: **Keep your Linux distros updated with the most recent patches**; upgrade if you are running something ancient/unsupported. Additionally, ESET mentions to always **keep your** [**UEFI revocations list**](https://uefi.org/revocationlistfile?ref=itsfoss.com) **updated** to prevent malicious bootloaders from loading and compromising your system. You could also follow some tips mentioned in our article to [improve the security of your Linux system](https://itsfoss.com/improve-security-linux/). If you are interested in learning more about the inner workings of Bootkitty, I highly suggest you read [ESET's deep dive blog](https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/?ref=itsfoss.com). For samples and the indicators of compromise (*IoCs*), you can visit ESET's [GitHub](https://github.com/eset/malware-ioc/tree/master/bootkitty?ref=itsfoss.com) repo. **Suggested Read** 📖 [9 Things I Do to Improve My Linux Computer’s SecurityWant to know some quick but effective methods to keep your Linux system safe? Here are some great tips for you!![](https://itsfoss.com/content/images/size/w256h256/2022/12/android-chrome-192x192.png)It's FOSSCommunity![](https://itsfoss.com/content/images/2024/10/easy-things-to-do-to-improve-computer-security.png)](https://itsfoss.com/improve-security-linux/)