http://ooz54wtg6y72a7rrymgsw5625sjy7ewgc5s32m2wchxkyos4lixpjjid.onion/taobio... some things to note about the samples: - the L1 image uses BIOS recovery to trigger actual exploit payload on unaddressable storage; that is to say it does not store the loader / malware directly on SPI flash memory. NSA has been adept at avoiding trivial detection via this route for a long time... - the L2 image is a configuration permanent denial of service. this is designed to disrupt target activities, rather than perform any traditional exploitation or exfiltration. with an impossible boot configuration, the system appears "dead". these techniques are the opposite of the Sednit approach where the malware resides as an UEFI module with malicious code stored on SPI flash memory. this makes it easy to detect (if you happen to catch it! :) as per the talk linked originally https://media.ccc.de/v/35c3-9561-first_sednit_uefi_rootkit_unveiled best regards,