Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.
However, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Victoria’s Secret pulls down website amid security incident
May 28, 2025
Clothing and lingerie retailer Victoria’s Secret suspended most of the functionality of its website and some in-store services to “address a security incident,” according to a statement posted to the company’s website on Wednesday. “We identified and are taking steps to address a security incident,” a Victoria’s Secret spokesperson told Reuters in an email on Wednesday. ...
- Zanubis in motion: Tracing the active evolution of the Android banking malware
May 28, 2025
Zanubis is a banking Trojan for Android that emerged in mid-2022. Since its inception, it has targeted banks and financial entities in Peru, before expanding its objectives to virtual cards and crypto wallets. The main infection vector of Zanubis is impersonating legitimate Peruvian Android applications and then misleading the user into enabling the accessibility permissions. Once ...
- Earth Lamia Develops Custom Arsenal to Target Multiple Industries
May 27, 2025
Trend Micro researchers have been tracking an active intrusion set that primarily targets organizations located in countries including Brazil, India, and Southeast Asia since 2023. The threat actor mainly targets the SQL injection vulnerabilities discovered on web applications to access the SQL servers of targeted organizations. The actor also takes advantage of various known vulnerabilities to ...
- Statement of solidarity by the North Atlantic Council concerning the malicious cyber activities against the Czech Republic
May 27, 2025
“We stand in solidarity with the Czech Republic following the malicious cyber campaign against its Ministry of Foreign Affairs. We recognise that the Government of the Czech Republic has attributed the responsibility to the People’s Republic of China, specifically APT31, which is associated with the Ministry of State Security. This campaign targeted a Czech MFA unclassified ...
- Retail Under Siege: What Recent Cyber Attacks Tell Us About Today’s Threat Landscape
May 27, 2025
When several major UK organizations, including well-known retail brands, found themselves caught in a cyber attack earlier this year, it made headlines. But this incident wasn’t the first, and it won’t be the last. It reflects a growing trend where attackers exploit third-party vendors to breach multiple businesses through a single point of entry. In one ...
- Dutch authorities claim Russia-backed group hacked into networks of police and NATO
May 27, 2025
A previously unknown Russian hacking group was behind attacks last year on the networks of the Dutch police, NATO and several European countries, Dutch intelligence agencies said on Tuesday. The group, nicknamed Laundry Bear by the security agencies, was most likely supported by the Russian state, the Dutch General Intelligence Agency and Military Agency said in ...