#KASPERSKY UNINSTALL TOOL 2015 SOFTWARE#

'The source of the infection starts with a set of hooks that intercept the execution of several functions in the EFI Boot Services Table, namely AllocatePool, CreateEventEx, and ExitBootServices,' explains Kaspersky in the report. The laced firmware component is CORE_DXE, which is called during the early phase of the UEFI boot sequence. In the case of MoonBounce, the implanting location is on the SPI flash memory of the motherboard, so not even a hard disk replacement can uproot it. They are very persistent because they nest in areas that can't be erased, like a reserved space on the disk. Generally, these tools hijack the booting sequence and initialize before the OS security components. This has been done multiple times before, with two recent examples being the FinFisher malware and the ESPecter backdoor.

#KASPERSKY UNINSTALL TOOL 2015 SOFTWARE#

UEFI (Unified Extensible Firmware Interface) is a technical specification that helps interface operating system (OS) and firmware software in computer systems.īeing able to plant malicious code called 'UEFI bootkit,' in the firmware is an excellent way to remain hidden from AVs and any security tools running on the OS level.

The discovery of MoonBounce is the work of researchers at Kaspersky, who have published a detailed technical report on their findings. Security analysts have discovered and linked MoonBounce, ' the most advanced' UEFI firmware implant found in the wild so far, to the Chinese-speaking APT41 hacker group (also known as Winnti).ĪPT41 is a notorious hacking group that has been active for at least a decade and is primarily known for its stealthy cyber-espionage operations against high-profile organizations from various industry sectors.

Kaspersky uninstall tool 2015