Attackers may exploit CVE-2024-7344 to bypass UEFI Secure Boot and deploy a malicious bootkit, achieving persistence and potentially exfiltrating sensitive data or disrupting system operations.
Tag: T1542.003
Bootkitty – UEFI Bootkit for Linux
Bootkitty is a UEFI bootkit that is executed early in the boot process, before the operating system is loaded. It installs hooks to intercept and modify the normal boot process, allowing it to persist even if the operating system is reinstalled or updated. The bootkit specifically targets the GRUB bootloader and the Linux kernel, patching them in memory to disable security checks and load malicious code.