ºÚÁÏÕýÄÜÁ¿

In the past several weeks, two separate bootkits have been reported publicly, and . These malicious tools bypass operating system security capabilities by executing first and modifying the kernel as it loads in the boot process. 

Eclypsium researchers have been tracking these bootloaders for an extended period of time, and new indicators of compromise (IOCs) have been released to specifically identify the types of attacks by these bootloaders.

The Health-ISAC Threat Operations Center is releasing these reports, which can be accessed , for FinSpy, and , for ESPecter, to improve the overall security and threat awareness of the Health-ISAC member community