Glupteba Botnet Evades Detection with Undocumented UEFI Bootkit

Researchers report that the Glupteba botnet has incorporated an undocumented UEFI bootkit (based on a modified EfiGuard) to achieve stealthy persistence; Glupteba remains a modular information-stealing backdoor used for cryptocurrency mining, proxying, credential theft, and payload delivery, distributed via multi-stage infection chains (PrivateLoader/SmokeLoader/PPI) and employing the Bitcoin blockchain as a resilient backup C2, with widespread activity observed across multiple countries.