1. Depends on the BIOS if it can connect to the internet. Most modern UEFI are able to do so, but usually don't for security reasons
2. Depends on the Malware. When the Malware is in the BIOS it could supply the necessary "driver" (code) to utilize your Network connection and might even implement DHCP so it get an IP and then I could probably connect to the internet and send data there.
3. That Malware needs to be able to understand the Filesystems (e.g. NTFS, FAT32, ext4, ...). Most BIOS are limited to only be able to read FAT32, but again your Malware might be able to expand the capabilites.

Overall it depends on the Malware, your BIOS and Mainboard. For the malware to actually do this, it would need either presupplied network code from the BIOS or would need to have the specific code for that mainboard model to utilize the network components.

Also a counter Question: Do you mean BIOS, EFI or UEFI? A malware for a UEFI would be simpler to implement than for a BIOS, because BIOS is not really standardized, while UEFI is ("Universal Extensible Firmware Interface", the universal and extensible are the issue here).

TLDR: Yes it can reach the internet, even though hard.

You can see it like this: Windows and Linux are also able to access the internet and essentially can't do more than a BIOS.

Greetings.

PS: your malware would also need the usual IP-Networkingstack implemented. e.g. IPv4 Packets, Ethernet-Frames, maybe even DNS

1. Depends on the BIOS if it can connect to the internet. Most modern UEFI are able to do so, but usually don't for security reasons
2. Depends on the Malware. When the Malware is in the BIOS it could supply the necessary "driver" (code) to utilize your Network connection and might even implement DHCP so it get an IP and then I could probably connect to the internet and send data there.
3. That Malware needs to be able to understand the Filesystems (e.g. NTFS, FAT32, ext4, ...). Most BIOS are limited to only be able to read FAT32, but again your Malware might be able to expand the capabilites.

Overall it depends on the Malware, your BIOS and Mainboard. For the malware to actually do this, it would need either presupplied network code from the BIOS or would need to have the specific code for that mainboard model to utilize the network components.

Also a counter Question: Do you mean BIOS, EFI or UEFI? A malware for a UEFI would be simpler to implement than for a BIOS, because BIOS is not really standardized, while UEFI is ("Universal Extensible Firmware Interface", the universal and extensible are the issue here).

TLDR: Yes it can reach the internet, even though hard.

You can see it like this: Windows and Linux are also able to access the internet and essentially can't do more than a BIOS.

Also be aware of this: Can BIOS malware be installed from OS? You need to install the malware first before being able to do anything.

Greetings.

PS: your malware would also need the usual IP-Networkingstack implemented. e.g. IPv4 Packets, Ethernet-Frames, maybe even DNS