UEFI bootkit infected fully patched Windows machines
BlackX UEFI bootkit bypassed Secure Boot on fully updated Windows 11 systems three years after the original BlackLotus discovery.
Stories per day · 30 days
1 RSS
9 stories, newest first · one card per story
Stories tagged #bootkit
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
1
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
BlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
2
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.