EfiGuard

개요 EfiGuard는 부팅 시 Windows 부팅 관리자, 부트 로더, 커널을 패치하여 PatchGuard 및 DSEDriver Signature Enforcement를 비활성화하는 휴대용 x64 UEFI 부트킷입니다. EfiGuard를 시험해보고 싶다면 사용법으로 건너뛰세요. 기능 현재 Vista SP1부터 Windows 11까지 출시된 모든 EFI 호환 Windows x64 버전을 지원합니다. 사용하기 쉬움: 자동으로 Windows를 찾아 부팅하는 로더를 통해 USB 스틱 또는 Windows EFI 파티션에서 부팅할 수...

BlackLotus

BlackLotus BlackLotus は、Windows 向けに特別に設計された革新的な UEFI ブートキットです。内蔵の Secure Boot バイパスと Ring0/カーネル保護を備えており、削除の試みから保護します。このソフトウェアは HTTP ローダーとして機能することを目的としています。堅牢な永続性のおかげで、新しい暗号化方式によるエージェントの頻繁な更新は必要ありません。一度展開されると、従来のアンチウイルスソフトウェアはそれをスキャンして排除できなくなります。ソフトウェアは主に 2...

Orchestrated-Powershell-for-CVE-2023-24932-en

セキュアブート緩和オーケストレータースクリプト 概要 このPowerShellスクリプトは、マイクロソフトセキュリティガイダンスに記載されているCVE-2023-24932 のセキュアブート緩和手順を自動化します。レジストリの更新、再起動、イベントログの検証を含むプロセス全体を処理し、システムをBlackLotus UEFIブートキットから保護します。 特徴 完全自動オーケストレーション : スクリプトが複数回の再起動を含む各手順を案内し、各再起動後に自動的に再開します。 イベントログ検証 : 特定のイベントID（例: 1799、1037）をチェックして、更新が成功したことを確認します。...

slot2

slot2 slot2: a two-stage UEFI GRUB2 bootkit that persists a pre-OS networked implant on Amazon Linux 2023 on AWS EC2 UEFI x8664. by cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Summary slot2 is a bootkit for Amazon Linux 2023 on EC2. The AWS EC2 UEFI firmware load...

uefi_bootkit_softlanding

SOFTLANDING UEFI BOOTKIT — ARES-2026-0001 The first public documentation of the SoftLanding UEFI DXE bootkit — a multi-agent, cross-platform firmware implant that persists in SPI flash Ring -2, deploys kernel and userland agents, and survives OS reinstallation and BIOS updates. ⚡ QUICK CHECK — AR...

Researchers Discover "Bootkitty" – First UEFI Bootkit Targeting Linux Kernels

Cybersecurity researchers have shed light on what has been described as the first Unified Extensible Firmware Interface UEFI bootkit designed for Linux systems. Dubbed Bootkitty by its creators who go by the name BlackCat, the bootkit is assessed to be a proof-of-concept PoC and there is no...

Glupteba Botnet Evades Detection with Undocumented UEFI Bootkit

The Glupteba botnet has been found to incorporate a previously undocumented Unified Extensible Firmware Interface UEFI bootkit feature, adding another layer of sophistication and stealth to the malware. "This bootkit can intervene and control the operating system boot process, enabling Glupteba t...

NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems

The U.S. National Security Agency NSA on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. To that end, the agency is recommending that "infrastructure owners take action by hardening user...

NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems

The U.S. National Security Agency NSA on Thursday released guidance to help organizations detect and prevent infections of a Unified Extensible Firmware Interface UEFI bootkit called BlackLotus. To that end, the agency is recommending that "infrastructure owners take action by hardening user...

Microsoft's May Patch Tuesday Fixes 38 Flaws, Including 2 Exploited Zero-Day Bugs

Microsoft has rolled out Patch Tuesday updates for May 2023 to address 38 security flaws, including two zero-day bugs that it said are being actively exploited in the wild. Trend Micro's Zero Day Initiative ZDI said the volume is the lowest since August 2021, although it pointed out that "this...

BlackLotus UEFI Bootkit Exploits Windows 11 vulnerability

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary BlackLotus is a UEFI bootkit that can exploit a vulnerability in Windows 11 systems and is advertised and sold on underground forums for $5,000...

BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows

By Deeba Ahmed Security firm ESETs cybersecurity researchers have shared their analysis of the worlds first UEFI bootkit being used in… This is a post from HackRead.com Read the original post: BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows...

BlackLotus Malware Hijacks Windows Secure Boot Process

Researchers have discovered malware that "can hijack a computer’s boot process even when Secure Boot and other advanced protections are enabled and running on fully updated versions of Windows." Dubbed BlackLotus, the malware is whats known as a UEFI bootkit. These sophisticated pieces of malware...

BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11

A stealthy Unified Extensible Firmware Interface UEFI bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape. "This bootkit can run even on fully up-to-date Windows 11 systems with UEFI Secu...

BlackLotus Becomes First UEFI Bootkit Malware to Bypass Secure Boot on Windows 11

A stealthy Unified Extensible Firmware Interface UEFI bootkit called BlackLotus has become the first publicly known malware capable of bypassing Secure Boot defenses, making it a potent threat in the cyber landscape. "This bootkit can run even on fully up-to-date Windows 11 systems with UEFI Secu...

Researchers Discover UEFI Bootkit Targeting Windows Computers Since 2012

Cybersecurity researchers on Tuesday revealed details of a previously undocumented UEFI Unified Extensible Firmware Interface bootkit that has been put to use by threat actors to backdoor Windows systems as early as 2012 by modifying a legitimate Windows Boot Manager binary to achieve persistence...

New 'MosaicRegressor' UEFI Bootkit Malware Found Active in the Wild

Cybersecurity researchers have spotted a rare kind of potentially dangerous malware that targets a machine's booting process to drop persistent malware. The campaign involved the use of a compromised UEFI or Unified Extensible Firmware Interface containing a malicious implant, making it the secon...

LoJack for computers used to attack European government bodies

Security researchers have detected the first known instance of a UEFI bootkit being used in targeted campaigns against government entities across Central and Eastern Europe. The attack focuses on UFEI-enabled computers and relies on a persistence mechanism that has been stolen from a legitimate,...