CosmicStrand is a UEFI firmware rootkit found in some ASUS and Gigabyte motherboard firmware images. Kaspersky identified an older variant active from late 2016 to mid-2017 and a later variant active in 2020; the gap does not show that the same infections remained continuously active for three years. Researchers considered a Chinese-speaking origin plausible but did not attribute the malware to a confirmed actor.
What is CosmicStrand?
CosmicStrand is a rootkit implanted in UEFI firmware stored in a motherboard’s SPI flash chip. UEFI is part of the computer’s startup process and runs before Windows. Because the implant is in motherboard firmware rather than on the hard drive, restarting the computer, replacing its drive, or reinstalling Windows does not remove it.
Kaspersky described CosmicStrand in 2022 after finding it in firmware images containing a modified version of the legitimate CSMCORE EFI driver. The discovery revealed that an older variant had been used years before the public report.
What does “shows up again after three years” mean?
The phrase refers to a gap between observed activity, not proof that every infected computer was continuously compromised during that period. CSO reported on July 27, 2022, that CosmicStrand had been making victims since 2020 after being out of view for about three years. Kaspersky’s technical chronology distinguishes an older variant used from the end of 2016 into mid-2017 from a later variant active in 2020.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- AMD Socket AM4: Ready to support AMD Ryzen 5000 / Ryzen 4000 / Ryzen 3000 Series processors
- Enhanced Power Solution: Digital twin 10 plus3 phases VRM solution with premium chokes and capacitors for steady power delivery.
- Advanced Thermal Armor: Enlarged VRM heatsinks layered with 5 W/mk thermal pads for better heat dissipation. Pre-Installed I/O Armor for quicker PC DIY assembly.
- Boost Your Memory Performance: Compatible with DDR4 memory and supports 4 x DIMMs with AMD EXPO Memory Module Support.
- Comprehensive Connectivity: WIFI 6, PCIe 4.0, 2x M.2 Slots, 1GbE LAN, USB 3.2 Gen 2, USB 3.2 Gen 1 Type-C
| Period | What Kaspersky reported |
|---|---|
| Late 2016 to mid-2017 | Activity involving an older variant. |
| 2020 | Activity involving a later variant. |
| 2022 | Kaspersky publicly described the discovery and its technical findings. |
How does CosmicStrand interfere with the Windows boot process?
The analyzed implant changes the firmware’s startup path so malicious code can be introduced before normal Windows kernel execution. Kaspersky traced a sequence of hooks and modifications from the firmware into Windows:
- Firmware driver: The modified CSMCORE EFI driver changes the UEFI boot-service pointer for
HandleProtocol, causing the implant’s code to run when the bootloader is present. - Bootloader handoff: The code hooks the routine that transfers control from the bootloader, then alters the Windows loader’s transfer-to-kernel function.
- Kernel modification: The chain patches
ZwCreateSectionin the Windows kernel. Kaspersky reported that the implant attempted to disable PatchGuard, a Windows kernel-protection feature. - Payload retrieval: After boot, the malware waits about 10 minutes, checks connectivity through the Transport Device Interface, and downloads shellcode from command-and-control infrastructure in 528-byte chunks.
Kaspersky could not obtain the command-and-control payload. An in-memory user-mode sample it found created a user named aaaabbbb and added that account to the local administrators group. That sample shows one capability in the staged chain, but it does not establish the complete set of payloads used by CosmicStrand.
Rank #2
- AM4 socket: Ready for AMD Ryzen 3000 and 5000 series, plus 5000 and 4000 G-series desktop processors.Bluetooth v5.2
- Best gaming connectivity: PCIe 4.0-ready, dual M.2 slots, USB 3.2 Gen 2 Type-C, plus HDMI 2.1 and DisplayPort 1.2 output
- Smooth networking: On-board WiFi 6E (802.11ax) and Intel 2.5 Gb Ethernet with ASUS LANGuard
- Robust power solution: 12+2 teamed power stages with ProCool power connector, high-quality alloy chokes and durable capacitors
- Renowned software: Bundled 60 days AIDA64 Extreme subscription and intuitive UEFI BIOS dashboard
Which computers and users were observed?
Kaspersky found the two known variants in firmware images from ASUS or Gigabyte motherboards, particularly systems using Intel’s H81 chipset. These are the systems represented in the analyzed samples; the findings do not establish that every board from either manufacturer, or every H81 system, was affected.
Kaspersky identified victims in China, Vietnam, Iran, and Russia. The visible victims were private individuals using Kaspersky products, and researchers could not tie them to a particular organization or industry. Those observations come from one vendor’s telemetry and are not a measure of total infections or worldwide prevalence. No reliable public total for infections or financial losses was provided.
Rank #3
- AMD AM4 Socket and PCIe 4.0: The perfect pairing for 3rd Gen AMD Ryzen CPUs
- Ultrafast Connectivity: 1x PCIe 4.0 x16 SafeSlot, WiFi 6 (802.11ax), 1Gb LAN, dual M.2 slots (NVMe SSD)—one with PCIe 4.0 x4 connectivity, USB 3.2 Gen 2 Type-A , HDMI 2.1 (4K at 60HZ), D-Sub & DVI
- Comprehensive Cooling: VRM heatsink, PCH heatsink, hybrid fan headers and Fan Xpert 2 utility
- 5X Protection III: all-round protection with LANGuard, DRAM overcurrent protection, overvoltage protection, SafeSlot Core safeguards and stainless-steel back I/O
- Boosted Memory Performance: ASUS OptiMem proprietary trace layout allows memory kits to operate at higher frequencies with lower voltages to maximize system performance.
Was CosmicStrand created by a Chinese threat actor?
That is not established. Kaspersky observed code patterns also found in the MyKings botnet, which has Chinese-language associations. The researchers treated a Chinese-speaking developer or the use of shared Chinese-speaking malware resources as a possibility, but did not name a confirmed group or establish who operated CosmicStrand.
How could CosmicStrand have been installed?
The initial infection route remains unknown. Researchers could not determine whether attackers exploited a firmware vulnerability, used local malware that already had permission to write firmware, or tampered with a supply chain or software package. Kaspersky discussed the age of H81-era systems and historical firmware-security weaknesses as possible context, not as a confirmed cause.
Rank #4
- AMD Socket AM4: Ready to support AMD Ryzen 5000/4000/3000 Series Processors
- Enhanced Power Solution: Digital 3+3 VRM Design and premium chokes and capacitors for steady power delivery.
- Advanced Thermal Armor: Chipset heatsinks for better heat dissipation.
- Boost Your Memory: Compatible with DDR4 and supports 4 DIMMS with Extreme Memory Profile support.
- Comprehensive Connectivity: 1x Ultra Durable PCIe 4.0 x16 slot, 1x PCIe 4.0 M.2 slot, 1x PCIe 3.0 M.2 slot, 4x USB 3.2 Gen 1 ports for hassle-free setup.
Can reinstalling Windows remove it?
No. A Windows reinstall or disk wipe affects the operating system and storage drive, while CosmicStrand resides in motherboard SPI flash. Kaspersky’s stated removal approach is to reflash the UEFI firmware.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do if a firmware rootkit is suspected?
UEFI recovery is a firmware-level repair, not an ordinary antivirus cleanup. If a machine is suspected of infection, a qualified technician or incident responder should handle the recovery:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBest Value
- AMD Socket AM5: Supports AMD Ryzen 9000/Ryzen 8000/Ryzen 7000 Series Processors
- DDR5 Compatible: 4 SMD DIMMs with AMD EXPO and Intel XMP Memory Module Support
- Unparalleled Performance: 12 plus2 plus2 Phases Digital VRM Solution
- Advanced Thermal Design and M.2 Thermal Guard: To Ensure VRM Power Stability and M.2 SSD Performance
- Stable Connectivity: 1 x PCIe 5.0 plus 2 x PCIe 4.0 M.2, USB 3.2 Gen 2x2 Type-C
- Preserve evidence: If the computer may be part of an investigation, consult an incident responder before changing firmware or reinstalling the operating system.
- Confirm the board: Identify the exact motherboard model and hardware revision so the recovery image matches the system.
- Obtain trusted firmware: Get the appropriate image from the manufacturer’s support channel and use a trusted recovery procedure. Where feasible, have the image inspected or compared before flashing.
- Reflash safely: Use the manufacturer’s supported method when it can reliably restore the firmware. If it cannot, an external SPI programmer may be necessary; using one requires the correct chip, image, and handling procedure.
- Check the recovery: Have the technician verify that the intended firmware was written and that the system starts correctly before returning it to normal use.
After firmware recovery, assess the operating system separately: the known firmware implant is not the same thing as every possible component it may have delivered. The complete CosmicStrand payload set is unknown, so responders should base any further cleanup or credential actions on the evidence from the affected system.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
