bootkit

Bootkit is a type of malware that targets the boot process of a computer system. By infecting the boot sector, boot manager, or firmware used during startup, a bootkit loads before the operating system and can take control of the system at the earliest possible stage. This enables persistence across reboots and can hide its presence from standard security tools.

Bootkits can reside in the master boot record (MBR) of traditional disks, the partition boot record (PBR), or in the firmware of the motherboard’s BIOS/UEFI. They may modify the initial bootloader or insert a malicious component that is executed before the kernel, allowing them to intercept system calls, hide files, or install a full kernel rootkit.

Infection methods include social engineering, compromised software updates, infected removable media, supply-chain compromises, or exploiting firmware vulnerabilities.

Impact can involve stealthy operation, persistence across reboots, evasion of antivirus detection, potential data theft, privilege escalation, and remote control of the affected system.

Defense and mitigation strategies emphasize boot-time protections and firmware integrity. Use Secure Boot and Measured Boot (UEFI), keep firmware up to date, disable legacy boot where possible, and enforce disk encryption. Regular monitoring of boot sectors and using security solutions that scan at boot time can further reduce risk, along with robust backup practices and prompt incident response to suspected infections.