Blacklotus

BlackLotus is a harmful malware that targets the Unified Extensible Firmware Interface (UEFI) and Secure Boot systems, exploiting their vulnerabilities to gain persistent kernel access and privileges. It was first detected in 2022 when security researchers discovered a UEFI bootkit being sold on hacking forums for $5,000. By late 2022, BlackLotus had evolved into a user-mode component—an HTTP downloader—identified through telemetry data. The malware has the ability to bypass secure boot functionality, designed to prevent malware from loading during system startup, thereby disrupting operations and potentially stealing personal information. In May 2023, Microsoft patched a flaw in Windows Secure Boot (CVE-2023-24932) that was actively being exploited by the BlackLotus bootkit. This exploitation required either physical access or administrative rights to the system. Despite this patch, the threat persisted, with BlackLotus continuing to exploit the system's vulnerabilities, highlighting the ongoing challenges in maintaining Secure Boot security. The malware, which was also sold on Dark Web forums for $5,000, demonstrated the potential for future malicious activity related to Secure Boot. Solutions like Eclypsium's help enterprises monitor and track firmware threats throughout the infrastructure supply chain, including detecting BlackLotus, tampering of bootloaders and firmware, and supporting critical firmware updates for remediation. However, experts warn of an increasing number of implants exploiting similar flaws to maintain persistence, evading higher-level security measures. Therefore, it is crucial for organizations to remain vigilant about such threats and ensure they have robust security measures in place to mitigate the risks associated with malware like BlackLotus.