vulnerability
BadMFS Covert File System
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:L/AC:M/Au:S/C:C/I:C/A:N) | Sep 1, 2017 | Sep 1, 2017 | Feb 18, 2025 |
Description
BadMFS is a CIA developed covert file system which attempts to install itself in non-partitioned space. BadMFS provides an interface for a developer to interact with the covert file system, similar to typical Windows API functionality. BadMFS has been developed such that it can run as a kernel library to a device driver or other kernel thread.
BadMFS is installed as a component of the AngelFire malware framework. AngelFire uses BadMFS to store other related components. All files are obfuscated and encrypted.
Due to being a known component of the AngelFire framework a clean OS reinstall is recommended to remove any potential undetected malware, as removing only BadMFS does not guarantee removal of malware installed using it.
Solution
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.