--- title: Bootkitty: The First UEFI Bootkit Targeting Linux Revealed description: Bootkitty is the first known UEFI bootkit targeting Linux systems, specifically few versions of Ubuntu. Currently a proof-of-concept, Bootkitty persists... canonical: https://daily.dev/posts/bootkitty-the-first-uefi-bootkit-targeting-linux-revealed-1ok3kibtk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bootkitty: The First UEFI Bootkit Targeting Linux Revealed | daily.dev og:description: Bootkitty is the first known UEFI bootkit targeting Linux systems, specifically few versions of Ubuntu. Currently a proof-of-concept, Bootkitty persists... og:url: https://daily.dev/posts/bootkitty-the-first-uefi-bootkit-targeting-linux-revealed-1ok3kibtk og:image: https://api.daily.dev/og/posts/1oK3KIbTK.png og:image:alt: Bootkitty: The First UEFI Bootkit Targeting Linux Revealed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bootkitty: The First UEFI Bootkit Targeting Linux Revealed **[Collections](https://daily.dev/sources/collections)** · 3 min read · 3 upvotes · 0 comments ## Summary Bootkitty is the first known UEFI bootkit targeting Linux systems, specifically few versions of Ubuntu. Currently a proof-of-concept, Bootkitty persists through firmware infection even if the hard drive is replaced or reformatted. Exploiting a firmware vulnerability called LogoFAIL, Bootkitty can hijack the boot process and disable kernel signature verification. Researchers emphasize the need for vigilance and patching systems to protect against such evolving threats. ## Content # Bootkitty: Unveiling the First UEFI Bootkit Targeting Linux Systems ## Introduction A groundbreaking discovery in the cybersecurity world has caught the attention of researchers and security professionals alike. Bootkitty, the first known UEFI bootkit targeting Linux systems, has emerged, marking a significant development in the nature of firmware infections. This article delves into the details of Bootkitty, its capabilities, and its implications. ## What is Bootkitty? Bootkitty is a novel type of UEFI bootkit that specifically targets Linux systems, with a primary focus on a few Ubuntu versions. This malicious software infects a computer's firmware, ensuring it persists even if the hard drive is replaced or reformatted. Researchers have indicated that Bootkitty is currently a proof-of-concept rather than an active threat. ## Technical Analysis Bootkitty has been found to be signed by a self-signed certificate, which prevents it from running on systems with UEFI Secure Boot enabled. However, it is capable of disabling the kernel’s signature verification feature and preloading unknown ELF binaries during the Linux initialization process. The analysis revealed specific traces left by Bootkitty, such as modified kernel version strings and the LD_PRELOAD environment variable. Additionally, a related unsigned kernel module named BCDropper was discovered, which further emphasizes the evolving sophistication of this bootkit. ## Exploiting Vulnerabilities Researchers have identified that Bootkitty exploits a firmware vulnerability known as LogoFAIL. Disclosed a year ago, this vulnerability can hijack the boot process of Linux devices, potentially bypassing Secure Boot protections and facilitating the installation of Bootkitty. Although initially theoretical, the exploitation of LogoFAIL has now been observed in the wild. ## Implications and Future Threats The emergence of Bootkitty underscores the expanding threat landscape of UEFI bootkits beyond Windows systems. As a proof-of-concept, Bootkitty suggests ongoing development by threat actors who may be preparing for more sophisticated attacks in the future. Researchers emphasize the importance of vigilance and preparedness for potential future threats, despite the current lack of evidence for active infections. ## Conclusion The discovery of Bootkitty marks a significant milestone in cybersecurity. As the first UEFI bootkit targeting Linux systems, it highlights the evolving nature of firmware malware and the need for continued research and security measures. While Bootkitty remains a proof-of-concept at this stage, its capabilities and potential for future evolution cannot be ignored. Cybersecurity professionals must remain alert and ensure that their systems are patched against known vulnerabilities, such as LogoFAIL, to mitigate the risks posed by emerging threats like Bootkitty. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/bootkitty-the-first-uefi-bootkit-targeting-linux-revealed-1ok3kibtk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bootkitty: The First UEFI Bootkit Targeting Linux Revealed","url":"https://daily.dev/posts/bootkitty-the-first-uefi-bootkit-targeting-linux-revealed-1ok3kibtk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bootkitty-the-first-uefi-bootkit-targeting-linux-revealed-1ok3kibtk"},"datePublished":"2024-11-27T20:05:40.129Z","dateModified":"2024-11-29T22:45:13.585Z","description":"Bootkitty is the first known UEFI bootkit targeting Linux systems, specifically few versions of Ubuntu. Currently a proof-of-concept, Bootkitty persists...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e217eff59005614c225c030377e6bab5?_a=AQAEuj9","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e217eff59005614c225c030377e6bab5?_a=AQAEuj9","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bootkitty-the-first-uefi-bootkit-targeting-linux-revealed-1ok3kibtk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,linux,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Bootkitty: The First UEFI Bootkit Targeting Linux Revealed"}]} ```