MALWARE FAMILY

Rovnix

Internal ID: win.rovnix

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Rovnix is a bootkit and consists of a driver loader (in the VBR) and the drivers (32bit, 64bit) themselves. It is part of the Carberp source code leak (https://github.com/nyx0/Rovnix). Rovnix has been used to protect Gozi ISFB, ReactorBot and Rerdom (at least).

Threat Analysis

Rovnix is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.kernelmode.info/forum/viewtopic.php?f=16&t=981

→http://www.malwaredigger.com/2015/05/rovnix-dropper-analysis.html

→http://www.malwaretech.com/2014/05/rovnix-new-evolution.html

→https://0xc0decafe.com/malware-analysts-guide-to-aplib-decompression/

→https://blogs.technet.microsoft.com/mmpc/2014/05/04/the-evolution-of-rovnix-new-virtual-file-system-vfs/

→https://news.drweb.ru/?i=1772&c=23&lng=ru&p=0

→https://securelist.com/cybercriminals-switch-from-mbr-to-ntfs-2/29117/

→https://securelist.com/oh-what-a-boot-iful-mornin/97365

→https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/

→https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-RodionovMatrosov.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.rovnix

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Rovnix