iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
MoonBounce was a UEFI firmware implant Kaspersky discovered in one targeted-network case and reported on January 20, 2022. It was embedded in motherboard SPI flash rather than on the Windows drive, so reinstalling Windows or replacing that drive alone would not remove it. Kaspersky attributed the activity to APT41 or a closely affiliated actor with medium-to-high confidence; the initial infection route was unknown.
What MoonBounce was
UEFI is the firmware interface that helps initialize a computer and hand control to its operating system. A bootkit is malware that interferes with this early startup process so it can run before, or as, the operating system loads. MoonBounce was a firmware-level bootkit: Kaspersky found it in the CORE_DXE component of a firmware image stored in SPI flash on the motherboard.
That location matters. The SPI flash is separate from the system drive. A drive format, replacement, or Windows reinstall does not by itself rewrite motherboard firmware.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the attack chain worked
Kaspersky’s January 20, 2022 technical report described MoonBounce altering an existing firmware component rather than simply adding a new DXE driver. It intercepted EFI Boot Services functions and redirected execution through a sequence of hooks. That boot-stage chain eventually introduced a malicious driver into Windows kernel memory, which then enabled malware to run in user mode.
#1 Best Overall
- (User manual available if do as follow: click "AITRIP"(you can find "Sold by AITRIP" under Buy Now button), in the new page, click "Ask a question".)we will send you the manual asap）
- Test Clip Pin format: SOIC8 SOP8 matrix ,Programmer TL866 EZP2010 RT809H CH341A;Please confirm the chip voltage to avoid burning the chip.(This product only supports 3.3v 5V switching)
- SOIC8 SOP8 Clip DIP8 for in-circuit programming For EEPROM /25CXX/24CXX on ZIP USB;Serial port: Supports the USB to UART 12CSP port
- Test Clip Beryllium copper plating needle, without welding, can be directly inserted
- USB Programmer CH341A Series Burner Chip 24 EEPROM BIOS Writer 25 SPI Flash AE1185
- Firmware execution: MoonBounce’s hooks ran from the modified CORE_DXE component during startup.
- Windows kernel access: The hooks helped place a malicious driver in kernel memory as Windows loaded.
- User-mode activity: A later component attempted to contact a hardcoded command-and-control address and retrieve another payload.
Kaspersky could not recover that next-stage payload, so its exact capabilities are not established. The observed commands suggested lateral movement and data exfiltration; Kaspersky assessed the persistent implant as consistent with long-term espionage, rather than proving what the unrecovered payload did.
What Kaspersky observed—and what it did not
Kaspersky reported one detected MoonBounce firmware-rootkit case in an investigation of a targeted network linked to an organization that controlled several transportation-technology enterprises. Related malware, including ScrambleCross, also known as SideWalk, was found on other machines. That does not establish that those machines had MoonBounce too.
Rank #2
- EZP2019+ Upgraded High Speed USB SPI Programmer Support 24/25/26/93 Series chips
- High Speed USB Programmer EZP2019 Support 24 25 26 93 EEPROM 25 flash bios chip Support WIN7&WIN8
- You can add chips by yourself (only for 24 series eeprom, 25 series SPI FLASH, 93 series eeprom, 25 series eeprom)
- Full set of 12 sockets adapters including SOP8 test clip SOP8/16 1.8V adapter socket flash bois 24 25 EEPROM etc.
The vendor attributed the intrusion set to APT41 or an actor closely affiliated with it, with medium-to-high confidence. Its assessment drew on infrastructure and malware relationships and overlapping tactics; it is an attribution by Kaspersky, not independent proof of the operators’ identity. Kaspersky said the original infection vector was unknown. It considered remote access a possibility but said there was not enough evidence to reconstruct how the firmware was first compromised.
Recommended Free Tools
Kaspersky’s press release called MoonBounce the third known firmware bootkit case reported in the wild as of January 2022. That is a dated count of cases known to the vendor at publication, not a current total or a measure of how prevalent firmware implants are.
Rank #3
- Professional Repair Tool: This is a must have tool for OS X repairing, includes the host, 4 pcs write sockets, 1 pc universal board, and 1 pc U disk.
- LED Color Screen Display: The repair tool adopts LED color screen, which is more convenient to display and operate.
- Multiple Power Supply Methods: The repair tool supports Type C, Micro USB cable power supply, and supports four AAA batteries for power supply.
- Powerful Function: The SPI ROM data of all serial port for OS X from 2008 to 2020 can be written into the host.
- Applicable Model: This repair tool is applicable for OS X all series from 2008 to 2020, including for I OS X, for OS X Mini, for OS X Pro, for OS X Air.
How MoonBounce differed from earlier firmware bootkits
Kaspersky contrasted MoonBounce with LoJax and MosaicRegressor, which it described as adding DXE drivers. MoonBounce instead modified an existing firmware component. These comparisons concern the technical details described in Kaspersky’s January 2022 report:
| Bootkit | Storage location | Firmware technique | Persistence through disk replacement or OS reinstall | Boot-to-user-mode chain |
|---|---|---|---|---|
| MoonBounce | Motherboard SPI flash | Modified an existing CORE_DXE component | Yes; disk replacement or OS reinstall alone does not remove code stored in firmware | EFI Boot Services hooks led to a Windows kernel driver and then user-mode malware |
| LoJax | Not stated here (Kaspersky, January 20, 2022) | Added a DXE driver, according to Kaspersky | Not stated here (Kaspersky, January 20, 2022) | Not stated here (Kaspersky, January 20, 2022) |
| MosaicRegressor | Not stated here (Kaspersky, January 20, 2022) | Added a DXE driver, according to Kaspersky | Not stated here (Kaspersky, January 20, 2022) | Not stated here (Kaspersky, January 20, 2022) |
What to do if you are concerned about firmware malware
Kaspersky recommended preventive measures rather than a universal device-specific removal procedure. Firmware settings and protections vary by motherboard and system, so check the device maker’s documentation or involve a qualified incident-response professional if you suspect compromise.
Rank #4
- The read and write speed is faster. It only takes 3 seconds to read EN25T80 and 9 seconds to write EN25T80. It is currently the fastest BIOS chip programmer on the market.
- Automatically identify chip model (mainly for 25 series chips, 24/25/93/25/95 for EEPROM needs to be manually selected).
- Automatically detect whether the chip is placed;The chip supply voltage is automatically selected.
- It fully supports 25 SPI FLASH, 24 for EEPROM, 25 for EEPROM, 93 for EEPROM, 95 for EEPROM and other series of memory chips.
- EZP2023 USB SPI Programmer Full Set + 12 Adapter Support 24 25 93 95 for EEPROM Flash Bios for Windows Better Than EZP2019
- Install firmware updates from a trusted device vendor. Follow the manufacturer’s process for the exact computer or motherboard; do not use firmware files from unverified sources.
- Use Secure Boot and, where supported, BootGuard and TPM protections. Their availability and configuration depend on the device. They are protective controls, not proof that a system is clean.
- Use security tools that can inspect firmware images. Ordinary file or disk checks may not provide visibility into code stored in SPI flash.
- Do not treat a Windows reinstall or drive swap as remediation for a firmware implant. Those actions address the drive or operating system, not the separate firmware store.
If a firmware compromise is suspected, seek device-specific guidance from the manufacturer or a qualified responder before attempting firmware recovery. Kaspersky’s report establishes the implant’s location and persistence mechanism, but does not provide a removal recipe for every motherboard.
Why the discovery mattered
MoonBounce demonstrated a stealthy way to bridge firmware execution into Windows: it changed an existing core component, then used a sequence of hooks to reach kernel and user-mode code. Kaspersky GReAT researcher Mark Lechtik described that alteration as an innovation among comparable firmware bootkits observed in the wild at the time, saying it “makes the threat far stealthier.” The significance is technical; one observed case does not show that such implants were widespread.
Quick Recap
Best Value
- Fedora Linux 43 Latest Bootable USB Flash Drive – 64-Bit Live Installer | Plug & Play | Fast, Secure, and Modern Linux Operating System for PC and Laptop
- 🔥 Latest Fedora Linux 43 Release: Enjoy the newest and most advanced version of Fedora Linux, built for speed, performance, and reliability — powered by cutting-edge open-source technology.
- 💻 Plug & Play Installation: Boot directly from the included USB drive — no setup or downloads required. Try Fedora live or install it permanently on your system with ease.
- 🔒 Secure & Trusted Build: Professionally prepared using the official Fedora 43 ISO, verified and tested to ensure authenticity, security, and stability.
- ⚙️ Ideal for Developers & Power Users: Fedora 43 includes the latest software packages, GNOME desktop, and developer tools — perfect for programming, testing, or daily computing.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
