What Is a Rootkit? How Attackers Hide Deep in Your System

A rootkit is malicious software designed to hide deep within a system, at the operating system, firmware or hardware level, giving an attacker persistent, privileged access while actively concealing its own presence from normal detection tools. If you have wondered whether a fresh reinstall genuinely fixes this, the honest answer depends entirely on which type you are dealing with.

What Is a Rootkit?

A rootkit is malware built specifically to conceal its own presence and an attacker’s ongoing access, operating at a level deep enough within a system that standard security tools and even a knowledgeable user struggle to spot it. The name comes from “root,” the highest privilege level on Unix-like systems, reflecting the deep, privileged access these tools are designed to grant and protect.

MITRE ATT&CK catalogs this specifically under technique T1014, Rootkit, within its Defense Evasion tactic category, reflecting that a rootkit’s entire purpose is hiding, not the initial compromise itself.

A Rootkit Isn’t How Attackers Get In: It’s What They Do Once They’re Already Inside

This is the single most common misunderstanding about rootkits, worth correcting directly before anything else. A rootkit is not a delivery method or an initial infection vector the way phishing or an exploited vulnerability is. It is what an attacker installs after they already have access, specifically to maintain that access invisibly and escalate their privileges further within the compromised system.

Think of the distinction this way. An attacker might gain initial access through a phishing email, an exposed remote access service, or an exploited software vulnerability, exactly the kind of entry points covered in other malware and threat content. Once inside, installing a rootkit is a deliberate, separate second step, ensuring that even if the original entry point gets patched or discovered, the attacker retains hidden, privileged access through the rootkit itself.

This distinction genuinely matters for how you think about defense. Focusing entirely on preventing initial access, while important, misses that a sophisticated attacker plans for eventual detection at the entry point and specifically wants a rootkit in place as a fallback. Detecting and removing a rootkit is fundamentally a post-exploitation problem, meaning by the time one is confirmed, an attacker has already had privileged access for some period, however brief. This reframes the honest goal of rootkit detection: not preventing the rootkit itself, but minimizing how long an attacker’s privileged, hidden access persists before discovery, since the rootkit’s entire design assumes and depends on staying undetected for as long as possible.

The Types of Rootkits, From Easiest to Hardest to Remove

Rootkit types exist at genuinely different levels of a system, and that level directly determines how hard each one is to detect and remove.

1. User-Mode Rootkits

User-mode rootkits operate at the same privilege level as normal applications, intercepting and manipulating system calls from within regular user space. These are the easiest type to detect and remove, since they still leave traces visible to tools operating at a deeper system level.

2. Kernel-Mode Rootkits

Kernel-mode rootkits operate at Ring 0, the operating system’s own core privilege level, giving them the ability to directly manipulate what the operating system itself reports as true. This makes them considerably harder to detect, since the rootkit can actively hide its own files, processes and network connections from tools that rely on the operating system to report accurately.

3. Bootkits

Bootkits infect the boot process itself, loading before the operating system does and maintaining control from the very start of the system’s operation. Because they activate before most security software even loads, bootkits can survive a standard operating system reinstall entirely, since reinstalling the OS does not touch the boot sequence infrastructure the bootkit has compromised.

4. Firmware (UEFI) Rootkits

Firmware rootkits embed themselves in a device’s UEFI firmware, the software layer that runs before any operating system loads at all, existing on the motherboard itself rather than on the hard drive. This is why firmware rootkits survive not just an OS reinstall but a complete hard drive replacement, since the infection lives on hardware the drive swap never touches.

5. Hypervisor Rootkits

Hypervisor rootkits operate at Ring -1, below the operating system entirely, creating a thin virtualization layer that the actual operating system runs on top of without ever knowing it is being observed and controlled from underneath. This is the hardest rootkit type to detect and remove, since the compromised operating system has no visibility whatsoever into the layer controlling it.

Ring 0 vs Ring -1: Why a Hypervisor Rootkit Is Worse Than a Kernel Rootkit

Privilege rings describe layers of access on a computer, with lower numbers meaning greater control. Ring 0 is the kernel, the operating system’s own core, already privileged enough to control nearly everything the OS itself can see and report on. Ring -1 sits below that entirely, the hypervisor layer used for virtualization, existing beneath the operating system’s own awareness.

A kernel-mode rootkit at Ring 0 can lie to the operating system about what files, processes or connections exist, but it remains part of the same system the operating system is running as. A hypervisor rootkit at Ring -1 does something genuinely different: it runs the real operating system inside an invisible virtual layer the rootkit itself controls, meaning the operating system has no way to detect the rootkit at all, since from the OS’s own perspective, nothing unusual exists, because the entire concept of “the system” as the OS understands it is being fed to it by the compromised layer beneath. This is precisely why hypervisor-level compromise represents the deepest, most difficult rootkit category to detect using any tool running within the compromised operating system itself.

Real Examples: CosmicStrand, Kinsing, and What NCSC’s Current Cisco Advisory Reveals

CosmicStrand, a UEFI firmware rootkit discovered embedded in motherboard firmware on certain Gigabyte and ASUS boards, demonstrated exactly how firmware-level persistence works in practice, surviving both operating system reinstalls and hard drive replacements since the infection lived in the motherboard’s own firmware rather than on the drive at all. Kinsing, a Linux-focused threat actor and malware family, has repeatedly targeted cloud and container environments specifically, often combining cryptomining with rootkit-style techniques to maintain persistent, hidden access to compromised servers.

The most genuinely current, instructive example comes from an active NCSC and CISA joint advisory. In September 2025, a state-sponsored threat actor exploited vulnerabilities in Cisco ASA and Firepower firewall devices, deploying a bootkit called RayInitiator, a persistent GRUB bootloader infection flashed directly to the device, capable of surviving both reboots and firmware upgrades. RayInitiator then delivered additional malware onto the compromised device. By April 2026, CISA and NCSC jointly disclosed a related backdoor named Firestarter, found actively persisting on a compromised federal device months after the original vulnerabilities had already been patched.

Here is the genuinely striking part directly relevant to this entire guide’s central theme. Firestarter survived standard reboots and firmware updates entirely, continuing to grant attackers access even after the device had been patched against the original vulnerability. Investigators found the only reliable way to guarantee removal required a hard power cycle combined with full device reimaging, not a standard patch or restart. This is bootkit and firmware-level persistence playing out in a real, current, government-documented incident, precisely illustrating why the removal difficulty scale covered above is not theoretical. A rootkit operating at this level treats a patch, and even a routine reboot, as something to simply survive through, exactly the property that makes firmware and bootkit-level infections so much more dangerous than user-mode or even kernel-mode rootkits.

Can Antivirus Detect a Rootkit?

The honest answer is genuinely mixed, and depends heavily on which rootkit type is involved. Standard antivirus, which largely relies on scanning files and comparing them against known signatures, can sometimes catch user-mode rootkits, since these still leave detectable traces within normal file system and process activity.

Kernel-mode rootkits are considerably harder for standard antivirus alone, since a sufficiently capable kernel rootkit can actively manipulate what the operating system reports back to the antivirus software itself, effectively hiding from the very tool trying to find it. Firmware, bootkit and hypervisor-level rootkits sit largely outside what conventional antivirus can see at all, since these operate beneath or entirely outside the operating system layer antivirus depends on to function. Detecting these genuinely requires specialized tooling, firmware integrity verification, boot-level attestation, or dedicated rootkit scanners designed specifically to check levels standard antivirus never inspects.

Does Reinstalling Your OS Remove It? (And When It Genuinely Won’t)

This depends entirely on which rootkit type is present, and giving a blanket “yes, reinstall to fix it” answer, as many sources do, is simply inaccurate for several rootkit categories covered above.

Reinstalling the operating system genuinely does remove user-mode and most kernel-mode rootkits, since these live within the operating system’s own files and structures, which a clean reinstall wipes entirely. Reinstalling does not remove bootkits, since these infect the boot sequence itself, a layer that loads before the operating system and that a standard OS reinstall never touches. Reinstalling absolutely does not remove firmware or UEFI-level rootkits, since these live in the motherboard’s own firmware, external to both the operating system and the hard drive, meaning even replacing the hard drive entirely leaves the infection intact. Hypervisor rootkits sit beneath the operating system in a virtualization layer a standard reinstall has no visibility into or ability to reach at all.

The Firestarter case covered above demonstrates this precisely. Even after the underlying vulnerability was patched, and even through standard reboots, the malware persisted, requiring a hard power cycle and full device reimaging specifically because standard remediation steps never touched the layer where the infection actually lived.

I Think I Have a Rootkit Right Now: What Do I Actually Do?

Disconnect the device from your network immediately, to limit any ongoing data exfiltration or lateral movement while you investigate further. Avoid a standard reboot alone as your first response, since, as the Firestarter case shows directly, some rootkits are specifically designed to survive exactly that action.

Run a dedicated rootkit scanner rather than relying solely on your existing antivirus, since standard tools may be exactly what the rootkit is designed to evade. For a suspected kernel-level or deeper infection, boot from external, trusted media to scan the system from outside its own compromised operating system, since a rootkit cannot hide from a scan it has no ability to influence. If firmware or bootkit-level compromise seems likely, involve a professional incident response team before proceeding further, since safely verifying and removing infection at this level often requires specialized tooling and expertise beyond what a standard IT process covers.

How Do You Detect and Defend Against Rootkits Going Forward?

Enable UEFI Secure Boot wherever supported, since this specifically verifies the integrity of the boot process before the operating system loads, directly addressing the bootkit persistence mechanism covered above. Keep firmware updated on all devices, not just operating systems and applications, since firmware-level patches close exactly the gap firmware rootkits exploit.

Deploy endpoint detection and response tooling capable of behavioral monitoring rather than relying on signature-based antivirus alone, since behavioral analysis can flag the unusual activity a well-hidden rootkit still generates even while concealing its own files and processes. Limit administrative privileges as a standing practice, since privilege escalation is a necessary step for most rootkit installation, and an environment where few accounts hold elevated access genuinely narrows an attacker’s path to installing one in the first place. Cyber Security Solutions Ltd increasingly recommends firmware integrity monitoring specifically for organizations running the kind of internet-facing network devices, firewalls, VPN appliances, that recent advisories like the Cisco case above have shown are genuinely being targeted at exactly this level.

Conclusion

Rootkits succeed by hiding at exactly the level your existing security tools are least equipped to inspect, which is why understanding the type you are dealing with matters more than a generic removal answer ever could. Start by confirming whether your own critical devices have Secure Boot and firmware update discipline genuinely in place. To get a firmware and rootkit risk assessment for your organization’s network devices, visit cybersecuritysolutionsltd.com for expert support from Cyber Security Solutions Ltd.