Malware: ROCKBOOT

Description

[ROCKBOOT](https://attack.mitre.org/software/S0112) is a [Bootkit](https://attack.mitre.org/techniques/T1542/003) that has been used by an unidentified, suspected China-based group. (Citation: FireEye Bootkits)

External References

• mitre-attack
• FireEye Bootkits

Techniques Used by This Malware

• T1542.003 — Bootkit

APT Groups Using This Malware

• APT41