Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.
However, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Exploitation of critical path traversal vulnerability (CVE-2024-41713) and 0-day path traversal vulnerability (CVE-2024-55550) in Mitel MiCollab
December 11, 2024
After proof-of-concept technical details were published on 5 December 2024 for CVE-2024-41713 and CVE-2024-55550, exploitation activity chaining these two Mitel MiCollab vulnerabilities has been reported. MiCollab is a cloud-based platform that integrates chat, voice, video, and SMS messaging for teams. Vulnerability details CVE-2024-41713 is a vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab ...
- Cleo Releases Security Advisory for Harmony, VLTrader, and LexiCom
December 11, 2024
Cleo has released a security advisory addressing two vulnerabilities in Cleo Harmony, Cleo VLTrader, and Cleo LexiCom, which are commonly used to manage file transfers. Cleo LexiCom is a desktop-based client solution for communication with major trading networks Cleo VLTrader is a server-level solution designed to meet the needs of mid-enterprise organisations Cleo Harmony is tailored ...
- Europol: Law enforcement shuts down 27 DDoS booters ahead of annual Christmas attacks
December 11, 2024
Law enforcement agencies worldwide have disrupted a holiday tradition for cybercriminals: launching Distributed Denial-of-Service (DDoS) attacks to take websites offline. As part of an ongoing international crackdown known as PowerOFF, authorities have seized 27 of the most popular platforms used to carry out these attacks. Known as ‘booter’ and ‘stresser’ websites, these platforms enabled cybercriminals and hacktivists ...
- Russia: Call center scheme that deceived hundreds from over 20 countries exposed in Moscow
December 11, 2024
Russia’s Federal Security Service (FSB), in collaboration with the Russian Interior Ministry, has exposed three Moscow-based illegal call centers that affected hundreds of citizens from more than 20 European and Asian countries, the FSB reported. “The unlawful activities of an organized crime syndicate that controlled the operation of three call centers in Moscow have been disrupted,” ...
- Scammers impersonating TSA pre-check to steal your money and information
December 10, 2024
A new warning as we head into the busy holiday travel season. It would be best to be on guard for fake TSA precheck websites. “We are seeing a disturbing trend of mimicking TSA-like sites,” says Karin Zilberstein with Guardio, a browser extension that identifies fake websites and other malware. She says Guardio has discovered ...
- Romanian energy supplier struck by ransomware attack
December 10, 2024
Romanian energy supplier Electrica Group has confirmed suffering a cyberattack in the latest incident to hit major institutions in the country. In a press announcement, the company said it was investigating an “ongoing cyberattack” together with the local law enforcement. The company did not detail the attack, its nature, goal, or the identity of the threat ...