LogoFAIL → UEFI bootkit → persistent ring-0

§ Context

Assumed environment: target endpoint has a vulnerable UEFI image parser (most major OEMs were vulnerable until 2024 patches). Attacker has user-level write access to the EFI partition (admin / live USB).

§ Steps

1. 01
   Admin shell / live USB footholdInitial Access

   T1078— Valid Accounts
2. 02
   Reboot triggers boot-logo parserPersistence

   T1547— Boot or Logon Autostart Execution
3. 03
   Survives wipe + reinstallDefense Evasion

   T1027— Obfuscated Files or Information
4. 04
   Drop malicious logo image into ESPInitial Access

   FW-LOGOFAIL— LogoFAIL (UEFI Image Parser RCE)
5. 05
   Pre-OS RCE before SecureBoot verifiesDefense Evasion

   FW-SECUREBOOT-BYPASS— SecureBoot Bypass
6. 06
   Install bootkit (BlackLotus / MoonBounce class)Persistence

   FW-BOOTKIT— UEFI Bootkit Persistence

§ References

• T1078Valid Accounts
• T1547Boot or Logon Autostart Execution
• T1027Obfuscated Files or Information

§ Frequently asked

What is the "LogoFAIL → UEFI bootkit → persistent ring-0" attack path?

Drop a malformed JPG/PNG/BMP into the EFI partition's boot logo path. Vulnerable vendor UEFI parses it pre-OS, executes attacker code before SecureBoot's verifier — install a bootkit that survives wipe + reinstall. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Admin shell / live USB foothold (T1078) — a initial access primitive. Assumed environment: target endpoint has a vulnerable UEFI image parser (most major OEMs were vulnerable until 2024 patches).

What is the final impact of this kill-chain?

The final step lands on Install bootkit (BlackLotus / MoonBounce class) (FW-BOOTKIT), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  LaunchDaemon persistence as root

  Once at root (via sudo or a local-exploit), drop a .plist into /Library/LaunchDaemons that re-implants on every boot — survives user logout and full power-cycle.

• Shared techniques2

  Process doppelgänging → spawn signed image with attacker bytes

  Use NTFS transactional file APIs to overlay an attacker image during process creation. The final mapped process differs from the on-disk file — AV sees only the legit signed image at scan time.

• Shared techniques2

  Cross-chain bridge validator-set bypass → mint wrapped tokens

  Bridge's signature-set check is off-by-one (Nomad-class) or accepts a zero address (Ronin-class). Mint wrapped tokens on the destination chain without locking on the source.