Loading malware…
BlackLotus is a Windows UEFI bootkit observed in the wild by late 2022 and publicly analyzed in 2023. It installs malicious boot components in the EFI System Partition, establishing persistence below the operating system and executing during startup. It was marketed on criminal forums as commercially available malware.
BlackLotus exploits CVE-2022-21894, also known as Baton Drop, to bypass UEFI Secure Boot using legitimate, signed but vulnerable Windows bootloaders. Because those bootloaders remained trusted until explicitly revoked, the attack could succeed on fully patched Windows 11 systems with Secure Boot enabled. Its persistence mechanism abuses Machine Owner Key enrollment to authorize attacker-controlled boot components while retaining an enabled Secure Boot state. BlackLotus can disable Microsoft Defender, hypervisor-protected code integrity, and BitLocker, weakening operating-system defenses. Its EFI System Partition installation can survive operating-system reinstallation if the infected partition is retained. Mitigation requires bootloader revocations and boot-chain remediation in addition to ordinary operating-system patching.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The BlackLotus bootkit exploited Baton Drop (CVE-2022-21894), a vulnerability in the Windows UEFI bootloader, to bypass Secure Boot. Vulnerable bootloaders were subsequently added to the UEFI revocation list.
Two CVE IDs, CVE-2026-8863 and CVE-2026-10797, cover the reported shims, and Microsoft revoked the vulnerable binaries in the dbx update shipped with its June 9 Patch Tuesday.
Two CVE IDs, CVE-2026-8863 and CVE-2026-10797, cover the reported shims, and Microsoft revoked the vulnerable binaries in the dbx update shipped with its June 9 Patch Tuesday.
description: Windows Bootmgr signing certificate authority since 2011. Revoked due to CVE-2023-24932
Через такой вектор можно развернуть полноценные UEFI-буткиты - BlackLotus или Bootkitty - даже при включённом Secure Boot. | CVE-2024-7344, обнаруженная исследователем ESET Martin Smolár, затрагивает UEFI-приложение Reloader - компонент нескольких утилит восстановления: Howyar SysReturn, Greenware GreenGuard, Radix SmartRecovery, Sanfong EZ-back System, CES NeoImpact. По данным ESET, также затронуты WASAY eRecoveryRX и SignalComputer HDD King.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Based on function similarity, we detect the replacement of bootmgfw.efi with the shim.
Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.
Attackers could bypass UEFI Secure Boot on a wide range of systems thanks to 11 Microsoft-signed UEFI shim bootloaders carrying vulnerabilities that have remained buried for more than a decade... Exploitation allows untrusted code to run during boot, opening the door to UEFI bootkits ... even with Secure Boot switched on.
Based on function similarity, we detect the replacement of bootmgfw.efi with the shim.
there are "limited indications" suggesting the involvement of a UEFI bootkit, likely exploiting CVE-2023-24932 ... a security feature bypass vulnerability in the Windows Boot Manager
Certain BlackLotus installation packages, as analyzed by ESET, refrain from carrying out the installation of the bootkit in case the affected host employs regional settings associated with Armenia, Belarus, Kazakhstan, Moldova, Russia, or Ukraine.
Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.
Attackers could bypass UEFI Secure Boot on a wide range of systems thanks to 11 Microsoft-signed UEFI shim bootloaders carrying vulnerabilities that have remained buried for more than a decade... Exploitation allows untrusted code to run during boot, opening the door to UEFI bootkits ... even with Secure Boot switched on.
With the modified MokList variable, an attacker can easily load any self-signed shim bootloader, which is actually another vulnerability in the chain used to keep secure boot active.
Secure Boot is a UEFI firmware feature that checks the digital signature of every piece of software trying to load before Windows boots... If a bootloader’s signature doesn’t match what Secure Boot trusts, the firmware refuses to run it.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
58 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Bootkit cité comme source d’inspiration pour RedLotus.
A UEFI bootkit that bypassed Secure Boot by exploiting older bootloader vulnerabilities, highlighting the risk of outdated Secure Boot certificates and the importance of continued DBX revocation updates.
A UEFI bootkit referenced as a potential post-bypass payload once untrusted code can execute during the boot process despite Secure Boot.
A malicious UEFI bootkit cited as an example of malware that could be installed by abusing vulnerable shim bootloaders to bypass Secure Boot.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.