18 matches found
EfiGuard
概述 EfiGuard 是一款便携式 x64 UEFI 启动工具包（bootkit），可在启动时修补 Windows 启动管理器、启动加载器和内核，以禁用 PatchGuard 和驱动程序签名强制（DSE）。 如果你只是想尝试 EfiGuard，请跳到使用。 功能特性 目前支持自 Vista SP1 至 Windows 11 所有已发布的与 EFI 兼容的 Windows x64 版本。 易于使用：可通过 U 盘或 Windows EFI 分区启动，加载器会自动查找并启动 Windows。驱动程序也可通过 UEFI Shell 或加载器手动加载和配置。 大量使用 Zydis...
uefi_bootkit_softlanding
SOFTLANDING UEFI BOOTKIT — ARES-2026-0001 The first public documentation of the SoftLanding UEFI DXE bootkit — a multi-agent, cross-platform firmware implant that persists in SPI flash Ring -2, deploys kernel and userland agents, and survives OS reinstallation and BIOS updates. ⚡ QUICK CHECK — AR...
slot2
slot2 slot2: a two-stage UEFI GRUB2 bootkit that persists a pre-OS networked implant on Amazon Linux 2023 on AWS EC2 UEFI x8664. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Summary slot2 is a bootkit for Amazon Linux 2023 on EC2. The AWS EC2 UEFI firmware load...
BlackLotus
BlackLotus BlackLotus 是一款专为 Windows 设计的创新 UEFI Bootkit。它内置了安全启动绕过以及 Ring0/内核保护功能，以防止任何删除尝试。该软件用作 HTTP 加载器。凭借其强大的持久性，无需频繁使用新加密方法更新 Agent。一旦部署，传统防病毒软件将无法扫描和清除它。该软件包含两个主要组件：安装在目标设备上的 Agent，以及管理员用于管理僵尸主机的 Web 界面。在此上下文中，僵尸主机指安装了 Agent 的设备。 仅供参考 ：此版本的 BlackLotus v2 已移除 baton drop，并用 bootlicker 替换了原始版本的...
Orchestrated-Powershell-for-CVE-2023-24932-en
Script orquestador de mitigación de Secure Boot Descripción general Este script de PowerShell automatiza los pasos de mitigación de Secure Boot para CVE-2023-24932 , tal como se describe en la Guía de seguridad de Microsoft. Gestiona todo el proceso, incluidas las actualizaciones del registro, lo...
Researchers Discover "Bootkitty" – First UEFI Bootkit Targeting Linux Kernels
Cybersecurity researchers have shed light on what has been described as the first Unified Extensible Firmware Interface UEFI bootkit designed for Linux systems. Dubbed Bootkitty by its creators who go by the name BlackCat, the bootkit is assessed to be a proof-of-concept PoC and there is no...
Glupteba Botnet Evades Detection with Undocumented UEFI Bootkit
The Glupteba botnet has been found to incorporate a previously undocumented Unified Extensible Firmware Interface UEFI bootkit feature, adding another layer of sophistication and stealth to the malware. "This bootkit can intervene and control the operating system boot process, enabling Glupteba t...
NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems
The U.S. National Security Agency NSA on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. To that end, the agency is recommending that "infrastructure owners take action by hardening user...
NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems
The U.S. National Security Agency NSA on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. To that end, the agency is recommending that "infrastructure owners take action by hardening user...
Microsoft's May Patch Tuesday Fixes 38 Flaws, Including 2 Exploited Zero-Day Bugs
Microsoft has rolled out Patch Tuesday updates for May 2023 to address 38 security flaws, including two zero-day bugs that it said are being actively exploited in the wild. Trend Micro's Zero Day Initiative ZDI said the volume is the lowest since August 2021, although it pointed out that "this...
BlackLotus UEFI Bootkit Exploits Windows 11 vulnerability
Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary BlackLotus is a UEFI bootkit that can exploit a vulnerability in Windows 11 systems and is advertised and sold on underground forums for $5,000...
BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows
By Deeba Ahmed Security firm ESETs cybersecurity researchers have shared their analysis of the worlds first UEFI bootkit being used in… This is a post from HackRead.com Read the original post: BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows...
BlackLotus Malware Hijacks Windows Secure Boot Process
Researchers have discovered malware that "can hijack a computer’s boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows." Dubbed BlackLotus, the malware is whats known as a UEFI bootkit. These sophisticated pieces of malware...
BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11
A stealthy Unified Extensible Firmware Interface UEFI bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape. "This bootkit can run even on fully up-to-date Windows 11 systems with UEFI Secu...
BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11
A stealthy Unified Extensible Firmware Interface UEFI bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape. "This bootkit can run even on fully up-to-date Windows 11 systems with UEFI Secu...
Researchers Discover UEFI Bootkit Targeting Windows Computers Since 2012
Cybersecurity researchers on Tuesday revealed details of a previously undocumented UEFI Unified Extensible Firmware Interface bootkit that has been put to use by threat actors to backdoor Windows systems as early as 2012 by modifying a legitimate Windows Boot Manager binary to achieve persistence...
New 'MosaicRegressor' UEFI Bootkit Malware Found Active in the Wild
Cybersecurity researchers have spotted a rare kind of potentially dangerous malware that targets a machine's booting process to drop persistent malware. The campaign involved the use of a compromised UEFI or Unified Extensible Firmware Interface containing a malicious implant, making it the secon...
LoJack for computers used to attack European government bodies
Security researchers have detected the first known instance of a UEFI bootkit being used in targeted campaigns against government entities across Central and Eastern Europe. The attack focuses on UFEI-enabled computers and relies on a persistence mechanism that has been stolen from a legitimate,...