Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

UEFI threats moving to the ESP: Introducing ESPecter bootkit

The ESPecter bootkit represents a sophisticated UEFI (Unified Extensible Firmware Interface) threat that targets the EFI System Partition (ESP) to establish persistent, stealthy footholds on compromised systems. Unlike traditional malware that operates within the OS environment, ESPecter operates at the pre-boot level, embedding itself within the ESP, a critical partition used by the firmware to load the operating system. This approach allows the bootkit to execute before the OS loads, evading many conventional security controls and detection mechanisms. The campaign leverages multiple advanced techniques mapped to MITRE ATT&CK patterns, including native API usage (T1106), pre-OS boot execution (T1542), boot or logon autostart execution (T1547), and bootkit deployment (T1542.003). It also employs dynamic-link library injection (T1055.001), hidden files and directories (T1564.001), hidden file systems (T1564.005), and obfuscation methods such as software packing (T1027.002) and file deobfuscation (T1140) to evade detection and analysis. The bootkit modifies system images (T1601.001) and code signing policies (T1553.006), impairing defenses (T1562) and renaming system utilities (T1036.003) to maintain persistence and stealth. It performs extensive system reconnaissance, including registry modification (T1112), system and process discovery (T1426, T1424), peripheral device discovery (T1120), and system time discovery (T1124). For data collection and exfiltration, ESPecter captures inputs (keylogging T1056.001, input capture T1417), screen captures (T1513, T1113), and automates data collection (T1119) with multi-stage command and control (C2) channels (T1104), using web protocols (T1071.001) and non-application layer protocols (T1095). It stages local data (T1074.001) and exfiltrates data over C2 channels (T1041), often using scheduled transfers (T1029). The campaign's complexity and use of multiple evasion and persistence techniques highlight its high threat level and sophistication, indicating a well-resourced adversary capable of long-term targeted attacks.

Detailed information about UEFI threats moving to the ESP: Introducing ESPecter bootkit. Get real-time updates, technical details, and mitigation strategies.

UEFI threats moving to the ESP: Introducing ESPecter bootkit - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat campaign titled "OSINT - Sharpening the Machete" is associated with the threat actor group "El Machete" and involves a range of sophisticated tactics, techniques, and procedures (TTPs) primarily centered around spear-phishing attacks. The campaign leverages spear-phishing via both attachments (MITRE ATT&CK T1193) and links (T1192) to initiate user execution (T1204), which is a critical step for initial compromise. Once inside the target environment, the threat actor employs scheduled tasks (T1053) to maintain persistence and uses various evasion techniques such as hiding files and directories (T1158), obfuscating files or information (T1027), software packing (T1045), and masquerading (T1036) to avoid detection by security tools. The campaign also involves credential theft techniques, including harvesting private keys (T1145) and credentials stored in files (T1081), which facilitate lateral movement and privilege escalation.

Reconnaissance and discovery activities are extensive, including system network connections discovery (T1049), peripheral device discovery (T1120), file and directory discovery (T1083), browser bookmark discovery (T1217), process discovery (T1057), and application window discovery (T1010). Data collection techniques include clipboard data capture (T1115), gathering data from local systems (T1005), and removable media (T1025). The adversary stages data (T1074) and captures input (T1056) and screen content (T1113) to maximize intelligence gathering.

For command and control (C2) and data exfiltration, the threat actor uses commonly used ports (T1043), fallback channels (T1008), and standard application layer protocols (T1071) to blend in with legitimate traffic. Remote file copy (T1105) and automated exfiltration (T1020) techniques are employed to transfer data stealthily. Data is often compressed (T1002) and encrypted (T1022) before exfiltration, which can occur over C2 channels (T1041), physical media (T1052), or scheduled transfers (T1029). The campaign is characterized by a moderate threat level and analysis confidence, with a low severity rating assigned by the source but involving a broad spectrum of attack vectors and techniques.

Overall, this campaign represents a targeted, multi-stage attack focusing on spear-phishing to gain initial access, followed by extensive reconnaissance, credential theft, persistence, and sophisticated data exfiltration methods. The use of obfuscation and masquerading techniques indicates a focus on evading detection and maintaining long-term presence within victim networks.

Detailed information about OSINT - Sharpening the Machete. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-attack-pattern="peripheral device discovery - t1120"'

Filter Threats