Vbootkit 2.0 is a boot-time rootkit that can run unsigned code with kernel privileges. The operating principle is quite simple – while the bootloader only loads signed binaries. An attacker would have to have physical access to the attacked machine, so that a disk containing the kit is inserted. It’s either that, or tricking the user into booting from an infected disk. Not impossible, but not easy either to run the bootkit itself is quite another matter.”]
Source: https://www.bitdefender.com/blog/hotforsecurity/boot-time-malware-comeback/