Loading malware…
MosaicRegressor is a modular, multi-stage espionage malware framework associated with a rare UEFI firmware implant used for highly persistent compromise on Windows systems. Public reporting identified it as one of the earliest real-world UEFI bootkits observed in the wild and the second publicly known case of malicious UEFI firmware used operationally by a threat actor. The firmware component resides in SPI flash and survives operating system reinstallation and even disk replacement, then re-establishes the operating-system infection during boot.
The UEFI implant is a DXE-stage bootkit derived largely from Hacking Team’s leaked VectorEDK codebase with minor customizations. Analyses describe four malicious firmware modules, including components based on rkloader and Hacking Team’s NTFS driver, plus a proprietary module that acts as the main persistent dropper. The implant registers execution before handoff to the OS bootloader, locates the Windows installation, writes a user-mode payload into the Windows Startup folder, and recreates that payload if it is removed, providing durable persistence from firmware into the OS.
Beyond the firmware stage, MosaicRegressor comprises multiple downloader and loader variants used for espionage and data gathering. Observed components retrieved additional payloads over several transport mechanisms, including standard web protocols, BITS-based transfer, WinHTTP, and email-based retrieval. At least one later-stage payload was reported stealing files from recent-document locations and packaging them for collection, consistent with intelligence-gathering objectives.
Victimology indicates targeted operations against diplomats and non-governmental organizations in Africa, Asia, and Europe, with identified victims showing links to North Korea-related themes. Some infections in the broader campaign were delivered through decoy document lures and self-extracting archives themed around DPRK topics. The exact initial infection vector for the UEFI firmware overwrite remains unknown. Physical access and abuse of a firmware update mechanism have both been discussed as plausible but unproven scenarios.
Attribution to a specific actor remains low confidence. Reporting has noted Chinese-language artifacts and limited infrastructure overlap with activity previously associated with Winnti-linked clusters, but no definitive public attribution has been established. MosaicRegressor is also notable for code and behavioral similarities to VectorEDK and for using unsigned DXE components, placing it alongside LoJax and MoonBounce as a landmark example of in-the-wild firmware-level persistence for cyber-espionage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This malware was part of a wider malicious framework that we dubbed MosaicRegressor; ... MosaicRegressor is a multi-stage and modular framework aimed at espionage and data gathering.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This malware was part of a wider malicious framework that we dubbed MosaicRegressor; ... MosaicRegressor is a multi-stage and modular framework aimed at espionage and data gathering.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.
Bootkits usually targeted MBR/ESP in the early 2010s, but as the cost of firmware attack decreased rapidly, the modern bootkits started to target DXE or even PEI.
На данный момент мы можем выделить два вектора атаки на UEFI-платформу: перепрошивка SPI и модификация менеджера загрузки.
Первым исполняется модуль SmmInterfaceBase. В его задачу входит создание c помощью API-функции CreateEventEx события EVENT_GROUPR_READY_TO_BOOT. Это событие наступает перед тем, как управление передается менеджеру загрузки. Тогда же вызывается обратный вызов NotifyFunction.
We were able to obtain only one variant of the subsequent stage, that installs in the autorun registry values | writing a malicious executable named ‘IntelUpdate.exe’ to the victim’s Startup folder. Thus, when Windows is started the written malware would be invoked as well.
Первым исполняется модуль SmmInterfaceBase. В его задачу входит создание c помощью API-функции CreateEventEx события EVENT_GROUPR_READY_TO_BOOT. Это событие наступает перед тем, как управление передается менеджеру загрузки. Тогда же вызывается обратный вызов NotifyFunction.
We were able to obtain only one variant of the subsequent stage, that installs in the autorun registry values | writing a malicious executable named ‘IntelUpdate.exe’ to the victim’s Startup folder. Thus, when Windows is started the written malware would be invoked as well.
Threat actors are continually looking for ways to improve the persistence of their malware and implants. Bootkits, meaning rootkits running at the firmware level, have been utilized for this purpose.
ReSetfTA.efi : UEFI application resetting the infection marker for debug
Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.
Compromising the Management Engine of a system would have considerable value on its own, but the leaks show that the group is using the unique privileges of the ME firmware as a way to gain indirect access to the UEFI/BIOS, drop additional payloads, and gain runtime control of the system below the operating system using System Management Mode (SMM).
73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A real-world UEFI malware strain discovered in 2020 that checked for a malicious file in the Windows startup folder on reboot and installed it if absent.
UEFI firmware implant/rootkit described as using an added DXE module to maintain persistence and drop an agent to disk at boot, surviving OS reinstall and disk replacement.
UEFI bootkit referenced as detectable by the Peacock UEFI attestation/monitoring framework; no additional details provided here.
Mentioned as another confirmed DXE-stage firmware implant for comparison/background.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.