APT / THREAT GROUP

Rovnix

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Rovnix is a bootkit and consists of a driver loader (in the VBR) and the drivers (32bit, 64bit) themselves. It is part of the Carberp source code leak (https://github.com/nyx0/Rovnix). Rovnix has been used to protect Gozi ISFB, ReactorBot and Rerdom (at least).

Threat Analysis

Rovnix is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.kernelmode.info/forum/viewtopic.php?f=16&t=981

→http://www.malwaredigger.com/2015/05/rovnix-dropper-analysis.html

→http://www.malwaretech.com/2014/05/rovnix-new-evolution.html

→https://0xc0decafe.com/malware-analysts-guide-to-aplib-decompression/

→https://blogs.technet.microsoft.com/mmpc/2014/05/04/the-evolution-of-rovnix-new-virtual-file-system-vfs/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

RovnixMayachokwin.rovnixBkLoaderCidox

External Intelligence

Malpedia: win.rovnix

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Rovnix