HDRoot Bootkit by Winnti Group Mimics Microsoft Net Command - How to, Technology and PC Security Forum | SensorsTechForum.com

HDRoot Bootkit by Winnti Group Mimics Microsoft Net Command

Researchers at Kaspersky Lab have recently published a report, focused on a cyber-espionage campaign strategized by a hacker organization dubbed the Winnti group. Winnti has been attacking enterprises in the online video game field since 2009. The bad news is the group is active again, this time targeting digital certificates signed by big software providers to conduct intellectual property theft. The source code of several game projects is also endangered by the hacking team.


Image Source: Secure List

What Tools Does Winnti Employ?

Winnti 1.x and 2.x

According to Kaspersky, the group has been using a piece of malicious code which is called Winnti as well. Researchers have divided all the variants of the tool into two generations – 1.x and 2.x. More about the creation and usage of Winnti malware, you can read in the Winnti tool report by SecureList.

HDRoot/ HDD Rootkit
The newest threat traced back to the Winnti group is called HDRoot and is based on a 2006 bootkit installer.

What Is a Bootkit?

A bootkit is a boot virus designed to hook and patch Windows, and then get loaded into the Windows Kernel. Due to these malicious capabilities, the bootkit gets unlimited access to the machine. Because the Master Boot Record is not encrypted, a bootkit may avoid full volume encryption.

HDRoot is described as ‘a universal platform for a sustainable and persistent appearance in a targeted system’. What is worse, it can be employed as a foothold for any hacker’s tool.

HDRoot is used for cyber-espionage and intellectual property theft. It was discovered ‘by accident’ – when a sample of malware drew the attention of GReAT (Kaspersky Lab’s Global Research and Analysis Team). What intrigued the researchers was:

  • The way this particular malware piece was protected with a commercial VMProtect Win64 executable and signed with a compromised certificate that belongs to a Chinese entity – Guangzhou YuanLuo Technology.
  • The fact that the malware was spoofed to look like a Microsoft’s Net Command net.exe.

HDRoot Malicious Capabilities and Targets

Those two factors made the malware sample quite suspicious. At a later stage of the analysis, Kaspersky experts revealed that the HDRoot bootkit could be used to launch other malicious tools. To be more specific, two types of backdoor malware were identified. One of them could bypass detection by professional anti-virus software in South Korea – AhnLab’s V3 Lite, AhnLab’s V3 365 Clinic and ESTsoft’s ALYac. Hence, a conclusion was reached – the Winnti team used the backdoor to attack targets in South Korea.

Kaspersky researchers consider the probability that the Winnti organization has primary interests in South East Asia. Some of its other targets are likely situated in Japan, China, Bangladesh and Indonesia. HDRoot infections have been also detected in the United Kingdom and Russia.

winnti victims - securelist

Image Source: Secure List

The geography of the targets is probably related to the Winnti attackers home country and their interest in local software entities. It may be that the hackers wanted to obtain access to popular local companies. However, the reasons they had (and still may have) are not quite clear yet.

Researches also consider the possibility that the HDD Rootkit has been created by someone who joined the Winnti group, after he had written the bookit. Another scenario is that the hackers used third-party code, which was available on the Chinese cyber black market. What is more, once Kaspersky spotted the attack by Winnti and started analyzing it, the group immediately took action and adapted it. The result – in a couple of weeks, a new variant of the threat was identified. The attack is still active.

How Are the Winnti/ HDRoot Attacks Initiated?

Researchers believe that most of the attacks are initiated with a phishing email sent to one or more company mailboxes. The email messages typically contain malicious attachments in self-extracting or a regular archive with an executable file. Exploitation of zero-day vulnerabilities has not been observed. Once the targeted company is penetrated, the Winnti group uploads a set of tools on the compromised computer and starts scanning the network resources.

Then, they escalate privileges and locate whatever information is valuable in the particular company. Next, stolen data is exfiltrated in compressed form to one of Winnti’s control & command servers. For that purpose, a back-connect TCP channel through a chain of TCP-proxy apps is used, as disclosed by researchers.

According to researchers at Kaspersky Lab, their products can successfully block HDRoot and protect users.


To avoid being compromised by malicious software, sustain a powerful AV solution.


Malware Removal Tool

SpyHunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Milena Dimitrova

Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum since the beginning. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim

More Posts

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share