New FinSpy Malware Variant Infects Windows Systems With UEFI Bootkit

Commercially developed FinFisher surveillanceware has been
upgraded to infect Windows devices using a UEFI^[1]
(Unified Extensible Firmware Interface) bootkit using a trojanized
Windows Boot Manager, marking a shift in infection vectors that
allow it to elude discovery and analysis.

Detected in the wild since 2011, FinFisher (aka FinSpy or
Wingbird) is a spyware toolset for Windows, macOS, and Linux
developed by Anglo-German firm Gamma International and supplied
exclusively to law enforcement and intelligence agencies. But like
with NSO Group’s Pegasus, the software has also been used to
spy on Bahraini activists^[2] in the past allegedly
and delivered as part of spear-phishing campaigns^[3] in September 2017.

FinFisher is equipped to harvest user credentials, file
listings, sensitive documents, record keystrokes, siphon email
messages from Thunderbird, Outlook, Apple Mail, and Icedove,
intercept Skype contacts, chats, calls and transferred files, and
capture audio and video by gaining access to a machine’s microphone
and webcam.

While the tool was previously deployed through tampered
installers of legitimate applications such as TeamViewer, VLC, and
WinRAR that were backdoored with an obfuscated downloader,
subsequent updates in 2014 enabled infections via Master Boot
Record (MBR) bootkits with the goal of injecting a malicious loader
in a manner that’s engineered to slip past security tools.

The latest feature to be added is the ability to deploy a UEFI
bootkit to load FinSpy, with new samples exhibiting properties that
replaced the Windows UEFI boot loader with a malicious variant as
well as boasting of four layers of obfuscation and other
detection-evasion methods to slow down reverse engineering and
analysis.

“This way of infection allowed the attackers to install a
bootkit without the need to bypass firmware security checks,”
Kaspersky’s Global Research and Analysis Team (GReAT) said^[4]
in a technical deep dive following an eight-month-long
investigation. “UEFI infections are very rare and generally hard to
execute, they stand out due to their evasiveness and
persistence.”

UEFI is a firmware interface and an improvement over basic
input/output system (BIOS) with support for Secure Boot^[5], which ensures the
integrity of the operating system to ensure no malware has
interfered with the boot process. But because UEFI facilitates the
loading of the operating system itself, bootkit infections are not
only resistant to OS reinstallation or replacement of the hard
drive but are also inconspicuous to security solutions running
within the operating system.

This enables threat actors to have control over the boot
process, achieve persistence, and bypass all security defences.
“While in this case the attackers did not infect the UEFI firmware
itself, but its next boot stage, the attack was particularly
stealthy, as the malicious module was installed on a separate
partition and could control the boot process of the infected
machine,” the researchers added.