Wiping files is recoverable. Corrupting firmware often is not, at least not without a repair trip. T1495, Firmware Corruption, covers adversaries who overwrite or corrupt flash memory of the system BIOS or other firmware to make devices inoperable. MITRE files it under impact, for Linux, macOS, network devices and Windows.
How attackers use it
Firmware is software loaded and run from non-volatile memory on hardware devices, including the motherboard, hard drive and video cards. Adversaries may manipulate, overwrite or corrupt it to deny use of the system or device, in a way that stops it from booting. MITRE gives one example: corruption of the firmware that loads the operating system on a network device may make that device inoperable. Depending on the device, it may also result in data destruction.
MITRE's procedure examples show the range. A 2025 wiper campaign in Poland factory reset compromised devices, which hindered forensic investigation. Bad Rabbit used an executable that installed a modified bootloader to stop normal boot. A TrickBot module could write to or erase UEFI and BIOS firmware.
How to detect it
MITRE's detection strategy has four analytics.
- A firmware flashing utility run with elevated privileges, followed by raw access to a firmware device path or changes to boot settings.
- On Linux, direct writes to /dev/mem or /sys/firmware, combined with flashing tools such as flashrom.
- EFI update activity running through system processes or binaries outside normal patch windows, or using unsigned firmware packages.
- On network devices, a firmware image uploaded over TFTP, SCP or a web interface, followed by an unexpected reboot or loss of connectivity.
MITRE names no log sources. Process telemetry for flashing tools, change logs on network devices and a record of approved firmware windows are the useful data.
How to reduce the risk
MITRE lists three mitigations.
- Update software. Patch the BIOS and other firmware to prevent use of known vulnerabilities.
- Privileged account management. Prevent adversary access to privileged accounts, or the access needed to replace firmware.
- Boot integrity. Check the integrity of existing BIOS and device firmware to determine whether it is vulnerable to modification.
Check your own environment
- Inventory firmware versions for servers, network devices and storage, and compare them to the vendor's current releases.
- Restrict who can upload firmware images to network devices, and log every upload.
- Confirm secure boot or firmware integrity checks are on where hardware supports them.
- Keep offline copies of known good firmware images and config for key network devices.
Quick check
Why can network devices be a target of firmware corruption?
Corrupting firmware that loads the operating system can leave the device inoperable.
Name one mitigation from MITRE.
Update firmware, protect privileged accounts, or check boot integrity.
