{
  "family": "rovnix",
  "sample_count": 5,
  "category": "bootkit",
  "description": "Trojan:Win32/Rovnix is a highly sophisticated bootkit and trojan downloader designed to infect the Master Boot Record (MBR) or Volume Boot Record (VBR) to achieve deep, undetectable persistence.<br><br><b>What is Rovnix?</b><br>For general users, Rovnix is invisible. For incident responders and forensic analysts, Rovnix represents one of the most difficult classes of malware to eradicate. By infecting the boot sector, Rovnix executes before the Windows operating system even loads. This allows it to patch the Windows kernel in memory, subvert all local security software, and load its malicious drivers completely undetected by standard anti-virus scanners.<br><br><b>Infection Vectors & Threat Hunting</b><br>Rovnix is typically distributed by other malware downloaders, exploit kits, or spearphishing campaigns. Upon execution, the installer drops a malicious driver (often highly obfuscated) that overwrites the VBR. Upon the next reboot, the bootkit loads into memory, hooks the <code>INT 13h</code> disk interrupt, and intercepts the OS loading process. Threat hunters cannot rely on file-level scanning to find Rovnix. Instead, they must hunt for anomalous outbound network connections to DGA domains (used to download secondary payloads like Carberp) or use specialized forensic tools to analyze the raw disk sectors.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact of Rovnix is its ability to securely download and execute arbitrary secondary payloads while remaining completely hidden. Because it operates at Ring 0 (kernel level), it can intercept file system requests to hide its own components. Incident responders must perform offline forensic imaging (booting from a clean USB) to safely analyze the compromised MBR/VBR and extract the malicious driver payload for reverse engineering.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1014",
    "T1105",
    "T1568.002",
    "T1542.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Pre-OS Boot: Bootkit",
      "tactic": "Persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to prevent the bootkit from downloading its secondary payloads.",
    "Do not trust any telemetry, task manager, or local AV logs from the live system, as the kernel-level rootkit will spoof these results.",
    "Perform a forensic triage by booting the machine from a known-clean Live CD or USB to image the raw disk and analyze the boot sectors.",
    "To remediate, the OS must be entirely rebuilt, and the Master Boot Record (MBR) or EFI partition must be completely wiped and rewritten."
  ],
  "what_to_avoid": [
    "Do not attempt a standard 'System Restore' or 'Reset this PC', as these mechanisms do not overwrite the infected boot sectors.",
    "Avoid ignoring a Rovnix infection just because the system 'seems fine'; it is actively preparing the environment for a massive ransomware or banking trojan drop."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}