Earlier this year, a study of leaked chats of the infamous Conti ransomware group suggests that the syndicate has been working on a  set of firmware attack methods accessing privileged code on affected devices.

“Control over firmware gives attackers virtually unmatched powers both to directly cause damage and to enable other long-term strategic goals,” firmware and hardware security firm Eclypsium said in a report shared with The Hacker News.

“Such level of access would allow an adversary to cause irreparable damage to a system or to establish ongoing persistence that is virtually invisible to the operating system.”

The attacks are specifically directed at embedded microcontrollers such as the Intel Management Engine (ME), a privileged component forming part of the company’s processor chipsets. These attacks can circumvent the operating system. 

The chat of the Conti members reveals that the group vowed to support Russia’s invasion of Ukraine. Further, the chat also shows the syndicate’s attempts to mine vulnerabilities related to ME firmware and BIOS write protection.

This entailed finding undocumented commands and vulnerabilities in the ME interface, achieving code execution in the ME to access and rewrite the SPI flash memory, and dropping System Management Mode (SMM)-level implants, which could be leveraged to even modify the kernel.

“By shifting focus to Intel ME as well as targeting devices in which the BIOS is write protected, attackers could easily find far more available target devices,” the researchers said.

That’s not all. Control over the firmware could also be exploited to gain long-term persistence, evade security solutions, and cause irreparable system damage, enabling the threat actor to mount destructive attacks as witnessed during the Russo-Ukrainian war.

“The Conti leaks exposed a strategic shift that moves firmware attacks even further away from the prying eyes of traditional security tools,” the researchers said.

“The shift to ME firmware gives attackers a far larger pool of potential victims to attack, and a new avenue to reaching the most privileged code and execution modes available on modern systems.”