A rootkit is malware that burrows into the deepest layer of a device — the operating system itself — so it can hide other malware, steal data and survive reboots and antivirus scans. The name says what it does: 'root' is the all-powerful administrator account on Unix systems, and a rootkit exists to keep that level of access long after the initial break-in. It is not the attack that hurts you; it is the tool that makes every other attack invisible. This guide covers what rootkits do, how they get in, the detection options that actually work, and what a small business should do about them in 2026.
TL;DR
- A rootkit hides at the deepest layer of an operating system, concealing files, processes and other malware from security tools.
- It rarely arrives alone: rootkits are the concealment layer for keyloggers, banking trojans, botnets and ransomware.
- User-mode rootkits hide in software; kernel-mode and bootkit variants hide in the OS itself or the firmware that starts it.
- Because a compromised OS cannot be trusted to report on itself, clean-media scans and secure boot matter more than any one antivirus product.
- Patching, MFA and staff awareness training stop the phishing that installs the rootkit in the first place.
What a rootkit actually does
Normal malware runs on the computer. A rootkit runs underneath it. Once installed with administrator-level privileges, a rootkit intercepts the operating system's own functions — the calls that list files, running processes or network connections — and edits the answers. The antivirus asks the system 'what is running?' and the compromised system, answering through the rootkit's filter, lies.
That one trick produces everything that makes rootkits dangerous:
- Invisibility. Rootkit files do not appear in file listings; rootkit processes do not appear in Task Manager or Activity Monitor.
- Persistence. Kernel-mode and firmware rootkits survive reboots, OS reinstalls and, in the worst cases, hard-drive replacement.
- Concealment for other malware. A rootkit can hide a keylogger's process, a miner's CPU usage or ransomware's staging activity from every tool that trusts the OS.
- Backdoor access. Most rootkits open a remote channel the attacker can use at will, undetected.
The types of rootkit, worst to mildest
- Firmware rootkits. Hide inside the code of hardware devices — network cards, routers, even the UEFI firmware that starts the computer. They survive reinstalling the operating system and wiping the drive. Rarest, hardest to clean, and usually answered with hardware replacement.
- Bootkits. Infect the boot process itself, loading before the operating system and its defences start. A bootkit can compromise Windows before any antivirus on that machine has begun running.
- Kernel-mode rootkits. Install inside the operating system's core (the kernel on Windows and Linux). This is the classic rootkit: full control of what the OS reports, at the cost of needing administrator access to install.
- User-mode rootkits. Hide inside ordinary applications — intercepting the APIs that programs use to list files and processes. Easier to write and easier to detect, but still effective against unpatched systems.
- Memory rootkits. Live in RAM only and vanish on reboot. Used for short, surgical intrusions because they leave nothing on disk for a scanner to find.
How a rootkit gets onto a machine
Rootkits need one thing most malware does not: administrator privileges. Getting them follows the same paths every other attack uses:
- Phishing attachments and fake downloads that carry an installer asking for admin rights — the dominant route for small business. A convincing fake invoice or 'delivery problem' attachment is all it takes when a staff member approves the prompt.
- Unpatched vulnerabilities in internet-facing servers, firewalls and remote-access software, exploited to gain system-level access without anyone clicking anything.
- Bundled software — cracked tools, 'free' utilities and pirated games whose installers carry the payload.
- Supply-chain compromise, where a legitimate software update itself carries the rootkit.
- Physical access, on machines where a visitor or departing employee can run an installer directly.
Notice the overlap with everything else in this threat series: the rootkit travels on the same vehicles as keyloggers and trojans. The difference is what happens after the install — and that difference is why rootkits are a symptom of a deeper gap rather than a threat class to defend against separately.
What a rootkit costs a business
A rootkit is rarely the headline incident; it is the reason the headline incident lasted months instead of hours. The attacker who holds kernel-level access can:
- Steal credentials and session tokens from every user of the machine, indefinitely.
- Remain through patch cycles, password resets and even OS reinstalls, re-exploiting each restored system.
- Stage ransomware or data exfiltration from a position no monitoring tool can see.
The Australian scale of the surrounding threat is measured: the Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25 — an average of one every six minutes — and the average self-reported cost for a small business rose 14 per cent to $56,600 per report (ASD Annual Cyber Threat Report 2024-25). A long-dwell rootkit infection sits in the expensive tail of that distribution: weeks of quiet access before anything visible happens.
Why rootkits are hard to detect — and what works anyway
The paradox at the centre of rootkit detection: a tool running on a compromised operating system cannot trust that operating system's answers. So detection works by stepping outside the compromised environment:
- Secure boot and measured boot. Modern UEFI firmware verifies each stage of the boot chain is unmodified, which closes most bootkit doors before Windows starts.
- Clean-media scanning. Boot the suspect machine from a trusted USB recovery environment and scan from there — the malware is not running, so it cannot hide.
- Behaviour-based endpoint detection. Modern EDR watches for the rootkit's own behaviour — driver loading anomalies, direct disk access, tampering with security tools — rather than trusting file listings.
- Comparison scanning. Tools that list system state through two different paths and flag the mismatches: files that exist on disk but not in the directory listing.
None of this is exotic, but it only works when it is set up before the infection. That is the recurring lesson of this attack class.
How to stop rootkits
- Patch relentlessly. Kernel exploits and internet-facing vulnerabilities are the no-click entry routes. Critical patches on internet-facing systems within 48 hours is the standard to hold.
- Remove admin rights from daily work. A rootkit needs elevation to install; standard-user accounts deny it that foothold. This single setting defeats more rootkit installs than any scanner.
- Turn on Secure Boot and keep firmware updated on every machine.
- Run endpoint protection with behaviour detection — signature scanning alone misses rootkits by design.
- Restrict software installation, including the 'free utility' downloads that bundle installers.
- Train the approval instinct. The admin-rights prompt is the rootkit's last obstacle, and the person holding the mouse decides it. That decision is what awareness training builds.
Why awareness training is the upstream control
Every rootkit entry route that involves a human — the attachment, the fake download, the elevation prompt — is a decision made in a few seconds by a staff member. Technical controls shrink the blast radius; training reduces the number of times the decision goes the wrong way. Cyber Aware's security awareness training runs monthly and rehearses exactly these lures, and anyone who clicks a simulated phishing email lands in remediation training the same day — closing the delivery route the rootkit depends on. Human risk reporting then shows month by month whether click rates are falling and reporting is rising across the team.
For the technical side — patch cadence, admin rights, secure boot, endpoint coverage — a cyber security gap assessment shows which controls you can already evidence and which to close next, before an incident or an auditor asks.
FAQ
What is a rootkit in simple terms? Malware that hides inside the deepest layer of a device's operating system so it can conceal itself and other malware from security tools. The name comes from 'root', the all-powerful administrator account.
Can antivirus detect a rootkit? Sometimes — but a rootkit running at kernel level can hide from a scanner that trusts the compromised OS. Detection improves with behaviour-based endpoint tools, secure boot and clean-media scans run from outside the infected system.
How do I remove a rootkit? Boot from clean media and scan from outside the compromised OS. Kernel and firmware rootkits often make reinstall insufficient; in serious cases the reliable answer is reimaging from a known-good source and, for firmware infections, hardware replacement.
Are rootkits common in 2026? Full kernel and firmware rootkits are uncommon in ordinary small-business incidents — they are expensive to build and maintain. The concealment techniques appear more broadly, though, in modern information stealers and loader malware.
What is the difference between a rootkit and a trojan? A trojan is the delivery disguise — malware posing as legitimate software that the user installs. A rootkit is the persistence and concealment layer that may be delivered by that trojan. One gets in; the other hides.
Does Windows Secure Boot stop rootkits? It stops most bootkits, which are the class that infects before the OS starts. It cannot stop a rootkit installed after the system is running with admin rights — which is why least privilege and staff awareness still matter alongside it.
One last thing
Two checks close most rootkit doors and cost an afternoon: confirm standard users cannot install software on work machines, and confirm Secure Boot is enabled on every laptop. Rootkits need elevation to install and a modified boot chain to persist — remove both, and the attacker's cheapest routes disappear.
Related guides
- What is a keylogger and how does it steal passwords? — the credential-stealing payload rootkits hide.
- What is a trojan? The malware that hides in plain sight — the disguise that delivers them.
- What is data exfiltration? — what leaves the network while the rootkit stays hidden.