Running Malware Below the OS - The State of UEFI Firmware Exploitation

This report reviews UEFI boot process security and categorizes modern bootkits by technique (ESP-only, DXE-only, DXE with SPI-based Secure Boot bypass, and MOK-based bypass), describing multiple real-world examples and their capabilities; it highlights firmware-level persistence, supply-chain risk, Secure Boot weaknesses (including CVE-2022-21894), and ties several bootkits to known APTs and criminal tooling.