Security researchers at ESET have uncovered “Bootkitty,” a groundbreaking UEFI bootkit specifically designed to target Linux systems. This proof-of-concept malware, primarily affecting specific Ubuntu versions, represents a significant shift from traditional Windows-focused bootkit threats.

The bootkit employs sophisticated techniques to compromise system security, including bypassing kernel signature verification and preloading malicious components during the boot process. It utilizes self-signed certificates while manipulating bootloader integrity checks through UEFI security protocols and GRUB function hooks.

Currently, Bootkitty faces several technical limitations. It requires Secure Boot to be disabled and only functions on specific Ubuntu distributions with particular GRUB and kernel versions. The malware exhibits stability issues, frequently causing system crashes.

The threat includes additional components such as the “BCDropper” kernel module and “BCObserver” rootkit, capable of concealing files, processes, and managing ports. While no real-world deployments have been detected, the malware appears to be in early development stages.

This discovery signals an evolution in Linux-targeted threats, particularly as enterprise adoption of Linux systems continues to grow. The emergence of Bootkitty emphasizes the need for enhanced security measures in Linux environments, as attackers increasingly focus on developing sophisticated boot-level attacks for these platforms.