MoonBounce, New UEFI Malware on the Loose

UEFI, short for Unified Extensible Firmware Interface, is simply put a system component, which connects the operating system with the rest of the system's firmware and devices. This is a low-level component, which is not erased/overwritten in case of formatting your hard drive or re-installing your operating system. And this is why cybercriminals are so interested in it – the development of UEFI malware allows them to gain persistence on a compromised device, hiding deep into the system's components. Even if the victim attempts to reinstall their operating system, they will fail to remove the malicious module. The latest piece of UEFI malware to be found in the wild MoonBounce Malware – it joins the ranks of several other implants, which have the ability to reside inside the UEFI.

The UEFI firmware is typically stored on the Serial Peripheral Interface (SPI) storage chip on computer motherboards. In order for it to be compromised, attackers will need to introduce a malicious firmware update, which would deliver the malicious code to the SPI chip.

Why is the MoonBounce Malware Special?

As already explained, this malware's unique ability reside in the UEFI firmware makes it much more difficult to identify and remove. But this property also gives it many other advantages. For starters, it does not need to run on system startup like most modern malware – instead, it is able to work independently of the operating system.

Of course, because of how stealthy the MoonBounce Malware is, its features are quite limited. Unfortunately, its ability to store its data in the UEFI firmware and operate from the system's memory turn it into a very difficult threat to deal with. It appears that its primary purpose is to enable attackers to deploy additional malware onto infected devices – just like a Trojan Dropper.

It seems that the victims affected by the MoonBounce Malware had sensitive data exfiltrated from their devices – industrial espionage is likely to be the primary purpose of this specific campaign. According to malware researchers, the MoonBounce campaign appears very similar to previous campaigns carried out by APT41, a Chinese threat actor.