Author Archives: Mark Lechtik, Vasily Berdnikov, Denis Legezo, Ilya Borisov

At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41. Continue reading MoonBounce: the dark side of UEFI firmware→