Rare 'CosmicStrand' UEFI Rootkit Swings into Cybercrime Orbit

A Windows firmware rootkit known as "CosmicStrand" has appeared in the cyberthreat firmament, targeting the Unified Extensible Firmware Interface (UEFI) to achieve stealth and persistence.

UEFI firmware is tasked with booting up Windows computers, including the loading of the operating system. As such, if the firmware is tainted with malicious code, that code will launch before the OS does — making it invisible to most security measures and OS-level defenses.

"This, along the fact that the firmware resides on a chip separate from the hard drive, makes attacks against UEFI firmware exceptionally evasive and persistent," researchers from Kaspersky explained in a posting on Monday. "Regardless of how many times the operating system is reinstalled, the malware will stay on the device."

Once triggered, the code deploys a malicious component inside the Windows OS, after a long execution chain. This component connects to a command-and-control server (C2) and waits for instructions to download additional malicious code snippets, which the malware maps into kernel space and assembles into a shellcode.

One shellcode sample obtained by Kaspersky was used to create a new user on the victim's machine and add it to the local administrators group.

"We can infer from this that shellcodes received from the C2 server might be stagers for attacker-supplied PE executables, and it is very likely that many more exist," according to the writeup.

As the US Department of Homeland Security (DHS) and Department of Commerce said in a March report on firmware threats, rootkits present a tremendous amount of risk.

“Attackers can subvert OS and hypervisor visibility and bypass most security systems, hide, and persist in networks and devices for extended periods of time while conducting attack operations, and inflict irrevocable damage,” the government agencies noted in a joint draft report (PDF).

This particular campaign appears highly targeted to specific individuals in China, with some cases seen in Iran and Vietnam, researchers noted. It's unclear what the ultimate endgame for Cosmic Strand is, but it's likely an espionage play; Kaspersky attributed the campaign to an as-yet-unknown Chinese-speaking advanced persistent threat (APT) with overlaps with the MyKings botnet gang.

Supply Chain, 'Evil Maid' Concerns

The researchers know very little about how the rootkit is making it onto peoples' machines. That said, supply chain weakness is a possibility, according to Kaspersky, with "unconfirmed accounts discovered online indicating that some users have received compromised devices while ordering hardware components online."

The modifications were specifically introduced to a specific driver by patching it to redirect to malicious code executed during system startup.

"We assess that the modifications [to the driver] may have been performed with an automated patcher," the Kaspersky researchers noted. "If so, it would follow that the attackers had prior access to the victim's computer in order to extract, modify and overwrite the motherboard's firmware. This could be achieved through a precursor malware implant already deployed on the computer or physical access (i.e., an evil maid attack scenario)."

They added that in the attacks, the implant burrowed into Gigabyte and ASUS motherboards specifically, which share the H81 chipset. This offers up another possibility for initial compromise.

"This suggests that a common vulnerability may exist that allowed the attackers to inject their rootkit into the firmware's image," according to the report.

Circa 2016

Very notably, CosmicStrand appears to have been used in the wild since the end of 2016, long before UEFI attacks were known to be a thing.

"Despite being recently discovered, the CosmicStrand UEFI firmware rootkit seems to have been being deployed for quite a long time," says Ivan Kwiatkowski, senior security researcher at Global Research and Analysis Team (GReAT) at Kaspersky. "This indicates that some threat actors have had very advanced capabilities that they've managed to keep under the radar since 2017. We are left to wonder what new tools they have created in the meantime that we have yet to discover."

UEFI rootkits are still rarely seen in the wild, thanks to how complex and difficult they are to develop — but they're not mythical, either. The first one ever officially spotted was observed by Qihoo 360 to be used by a China-backed APT in 2017; Kaspersky believes CosmicStrand to be related to that threat, which was called the Spy Shadow Trojan.

Then, ESET discovered one in 2018 being used by Russian state-sponsored actor APT28 (aka Fancy Bear, Sednit, or Sofacy). It was dubbed LoJax because of its underlying code, which was a modified version of Absolute Software’s LoJack recovery software for laptops.

Since then, others have infrequently come to light, such as MosaicRegressor and MoonBounce, which Kaspersky found in 2020 and 2022, respectively.

Kaspersky researchers warned that these types of rootkits continue to provide mysteries and raise questions, and deserve more attention from the analyst community.

"CosmicStrand is a sophisticated UEFI firmware rootkit [that] appears to have been used in operation for several years, and yet many mysteries remain," they noted. "How many more implants and C2 servers could still be eluding us? What last-stage payloads are being delivered to the victims? But also, is it really possible that CosmicStrand has reached some of its victims through package 'interdiction'? In any case, the multiple rootkits discovered so far evidence a blind spot in our industry that needs to be addressed sooner rather than later."

The feds agree. The aforementioned DHS-led joint draft report noted that firmware presented "a large and ever-expanding attack surface." They added that firmware security is often overlooked, even though it's one of the stealthiest methods by which an attacker can compromise devices at scale.