Jokes, conspiracy theories and other bullshit aside.
A rootkit dosent really.. Uhm, attack? A rootkit is just like any other malware but without any form of restrictions. This is because a rootkit runs in kernel mode. Which means the rootkit is not limited by the OS in any way, it can see, read, manipulate and change anything it wants. This is what makes rootkits so hard to detect and remove. You can literally tell any malware detection program that there is no file here or give it a random or another file strem as it attempts to detect the rootkit or anything else for that matter. There are no limits.
I would say as far as rootkit features go, undetectable and or covert channels for remote communications are a rather interesting topic. Hardware firmware infections are cool as well.
