Skip to content

S0112 ROCKBOOT

ROCKBOOT is a Bootkit that has been used by an unidentified, suspected China-based group. 1

Item Value
ID S0112
Associated Names
Type MALWARE
Version 1.1
Created 31 May 2017
Last Modified 09 February 2021
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1542 Pre-OS Boot -
enterprise T1542.003 Bootkit ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.1

Groups That Use This Software

ID Name References
G0096 APT41 2

References

Back to top