Masters of disguise

This Group‑IB report analyzes the Mosaic Regressor UEFI bootkit (built from Vector‑EDK/HackingTeam tools), documents its modules, provides a process to create a QEMU/OVMF test bench, details detection and hunting techniques (firmware/OS/network), and supplies extensive IOCs (module GUIDs, MD5s, file paths, mutexes, domains and IPs) plus mitigation recommendations mapped to MITRE ATT&CK and Shield.