Enter the BlackLotus: Analysis of the Latest UEFI Bootkit

[[correlate]]

Content source

https://socradar.io/enter-the-blacklotus-analysis-of-the-latest-uefi-bootkit/

The world of cybercrime is constantly evolving, and one of the latest threats to emerge is the BlackLotus bootkit. This malware is the first known bootkit capable of bypassing Secure Boot on Microsoft Windows 11 systems, making it a dangerous threat in the cyber world. The malware has been sold on various hacker forums for $5,000, while upgrading to a new version only costs $200. The 80 kB-sized BlackLotus bootkit has been available on hacker forums since October 2022.

Enter the BlackLotus: Analysis of the Latest UEFI Bootkit

BlackLotus uses the CVE-2022-21894 vulnerability to bypass the secure boot feature. Microsoft released a patch for this vulnerability, but...

socradar.io

 

[HarborFront]

So can current top-notch AV/AM or endpoints like DI and Harmony prevent this?

 

[[correlate]]

So can current top-notch AV/AM or endpoints like DI and Harmony prevent this?

While best-of-breed antivirus/anti-malware (AV/AM) solutions and advanced endpoint protection platforms such as Detection and Response (EDR) and Harmony can provide robust security measures, it is important to understand that the effectiveness of any security solution can vary depending on several factors, including the specific malware variant and its capabilities.

Given that the BlackLotus bootkit is designed to bypass Secure Boot on Windows 11 systems, it is possible that it could evade traditional security measures. However, reputable AV/AM solutions and advanced endpoint protection platforms often use proactive detection, behavioural analysis, machine learning and other sophisticated techniques to identify and block known and unknown threats.

 

[HarborFront]

While best-of-breed antivirus/anti-malware (AV/AM) solutions and advanced endpoint protection platforms such as Detection and Response (EDR) and Harmony can provide robust security measures, it is important to understand that the effectiveness of any security solution can vary depending on several factors, including the specific malware variant and its capabilities.

Given that the BlackLotus bootkit is designed to bypass Secure Boot on Windows 11 systems, it is possible that it could evade traditional security measures. However, reputable AV/AM solutions and advanced endpoint protection platforms often use proactive detection, behavioural analysis, machine learning and other sophisticated techniques to identify and block known and unknown threats.

Any AV/AM or endpoint blocked it? I can't find any such block report on the net

 

[[correlate]]

Any AV/AM or endpoint blocked it? I can't find any such block report on the net

It depends on the specific settings that each EDR allows.
But have a look at the video

 

[HarborFront]

It depends on the specific settings that each EDR allows.
But have a look at the video

I was expecting Harmony, DI and top-notch AV/AM to block it when it was released and make great announcement

Now that the sig is already available.........