Pitou

Pitou, also known as Backboot, is a Windows bootkit and kernel-mode spambot active since at least 2014. It infects Master Boot Record-based systems to achieve execution before the operating system fully loads, allowing it to bypass kernel-mode code-signing protections and install a malicious driver on both 32-bit and 64-bit Windows systems, including versions from Windows XP through Windows 10. Its architecture spans multiple boot stages and, on 64-bit systems, extends through the Windows boot chain into the kernel before launching its payload.

The malware’s primary purpose is to send spam from infected victim machines. Its spam functionality operates from kernel mode, and Pitou also includes resilient command-and-control logic through a domain generation algorithm used as fallback communications infrastructure. That DGA is unusually sophisticated in that it executes in kernel mode inside a custom virtual machine, uses encrypted string tables, dynamically resolved APIs, and date-based seeding, and generates batches of pronounceable domains across multiple top-level domains.

Pitou employs extensive stealth and anti-analysis measures. It stores components in disk space outside normal partitions, hooks the boot process across real mode, protected mode, and kernel initialization, and intercepts disk operations to conceal MBR infection by returning benign data to user-mode inspection. Additional evasion includes heavy obfuscation, anti-virtualization checks, and NDIS hooking to obscure network communication. Reverse engineering has also shown that Pitou uses a rootkit component with dynamically resolved API calls and custom virtualization to protect critical logic.

Pitou has been associated with drive-by download infections from compromised websites and delivery by other malware. It targets legacy BIOS/MBR environments rather than UEFI systems. Its combination of bootkit persistence, kernel-mode stealth, anti-VM behavior, and spam-bot functionality made it one of the more sophisticated late-stage MBR bootkits observed in the wild.