Merge pull request #669 from Delta-Sierra/main

add ESPecter Bootkit

clusters/tool.json

@@ -8439,7 +8439,18 @@
       },
       "uuid": "b1c4f468-1c55-40aa-bce4-c3772ef83d0c",
       "value": "BLUELIGHT"
+    },
+    {
+      "description": "ESET researchers have analyzed a previously undocumented, real-world UEFI bootkit that persists on the EFI System Partition (ESP). The bootkit, which we’ve named ESPecter, can bypass Windows Driver Signature Enforcement to load its own unsigned driver, which facilitates its espionage activities. Alongside Kaspersky’s recent discovery of the unrelated FinSpy bootkit, it is now safe to say that real-world UEFI threats are no longer limited to SPI flash implants, as used by Lojax.",
+      "meta": {
+        "refs": [
+          "https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/",
+          "https://github.com/eset/malware-ioc/tree/master/especter"
+        ]
+      },
+      "uuid": "d5b31712-a5b4-4b1c-9a74-4340abc61210",
+      "value": "ESPecter bootkit"
     }
   ],
-  "version": 147
+  "version": 148
 }