Glupteba Botnet Adds UEFI Bootkit to Cyberattack Toolbox

Glupteba, a long-running modular botnet and malware family, has been observed using a UEFI bootkit implant that lives in the EFI System Partition to execute before Windows boots, disable driver signature enforcement and PatchGuard, and thereby achieve resilient persistence; the report details its multifaceted capabilities (backdoor, infostealer, loader, cryptominer, ad fraud), global distribution, and the tradecraft (EfiGuard and other tools) used in recent campaigns.