From c89623e945897fd856adfab9482135563353162b Mon Sep 17 00:00:00 2001
From: Delta-Sierra <deborah.servili@gmail.com>
Date: Tue, 16 Nov 2021 08:17:37 +0100
Subject: [PATCH] add ESPecter bootkit

---
 clusters/tool.json | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/clusters/tool.json b/clusters/tool.json
index f9540ed..1985544 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -8439,7 +8439,17 @@
       },
       "uuid": "b1c4f468-1c55-40aa-bce4-c3772ef83d0c",
       "value": "BLUELIGHT"
+    },
+    {
+      "value": "ESPecter bootkit",
+      "description": "ESET researchers have analyzed a previously undocumented, real-world UEFI bootkit that persists on the EFI System Partition (ESP). The bootkit, which we’ve named ESPecter, can bypass Windows Driver Signature Enforcement to load its own unsigned driver, which facilitates its espionage activities. Alongside Kaspersky’s recent discovery of the unrelated FinSpy bootkit, it is now safe to say that real-world UEFI threats are no longer limited to SPI flash implants, as used by Lojax.",
+      "meta": {
+        "refs": [
+          "https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/",
+          "https://github.com/eset/malware-ioc/tree/master/especter"
+        ]
+      }
     }
   ],
-  "version": 147
+  "version": 148
 }