Olmasco bootkit: next circle of TDL4 evolution (or not)

(Publication) Google search: [1]

Olmasco bootkit: next circle of TDL4 evolution (or not)
Botnet	TDSS, TDL-4
Malware	Olmasco
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2012 / 2012-10-18
Editor/Conference	Eset
Link	http://blog.eset.com/2012/10/18/olmasco-bootkit-next-circle-of-tdl4-evolution-or-not blog.eset.com (blog.eset.com Archive copy)
Author	Aleksandr Matrosov
Type

Abstract

“ Olmasco (also known as SST, MaxSS) is a modification of the TDL4 bootkit family that we’ve been aware of since summer 2011. We started to track a new wave of activity from a new Olmasco dropper at the end of this summer. This bootkit family was the second to use VBR (Volume Boot Record) infection to bypass kernel-mode code signing policy since Rovnix (Rovnix bootkit framework updated) appeared in-the-wild.

Bibtex

 @misc{Matrosov2012BFR1185,
   editor = {Eset},
   author = {Aleksandr Matrosov},
   title = {Olmasco bootkit: next circle of TDL4 evolution (or not)},
   date = {18},
   month = Oct,
   year = {2012},
   howpublished = {\url{http://blog.eset.com/2012/10/18/olmasco-bootkit-next-circle-of-tdl4-evolution-or-not blog.eset.com}},
 }