ZeroAccess is a kernel mode rootkit that can infect vulnerable devices with malware. ZeroAccess is different from other types of rootkits because this rootkit doesn’t necessarily affect the normal behavior of the operating system on the infected device. Instead, ZeroAccess downloads malware on the infected device and then launches the malware to transform the vulnerable target device into a member of a botnet. Hackers can then launch a variety of different cyberattacks using the botnet, similar to how Necurs works.
ZeroAccess has infected close to 2 million vulnerable devices and caused massive loss of privacy and computing resources. ZeroAccess has also been shown to mine cryptocurrency via the compromised devices.