Loading malware…
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
According to Intrinsec, the attacker requires only physical access to the target workstation, a USB drive or PXE boot server... and serves an old, vulnerable PCA 2011-signed boot manager via USB or PXE boot.
the attack does not require specialized hardware. Physical access, a USB device or a PXE boot server may be sufficient to perform the attack.
This modified WinRE image launches the cmd.exe process during system startup.
The attack proceeds as follows: the attacker prepares a modified BCD (Boot Configuration Data) file pointing to a tampered SDI and serves an old, vulnerable PCA 2011-signed boot manager via USB or PXE boot.
According to Intrinsec, the attacker requires only physical access to the target workstation, a USB drive or PXE boot server... and serves an old, vulnerable PCA 2011-signed boot manager via USB or PXE boot.
When the boot manager loads a legitimate WIM file referenced by an SDI for integrity verification, it simultaneously allows a second, attacker-controlled WIM to be appended to the SDI’s blob table. The boot manager verifies the first (legitimate) WIM but actually boots from the second, which contains a WinRE image modified to launch cmd.exe with the BitLocker volume already decrypted and mounted.
During the attack, the system verifies a legitimate WIM file, while the actual boot process is performed from a second attacker-modified WIM image.
The attack proceeds as follows: the attacker prepares a modified BCD (Boot Configuration Data) file pointing to a tampered SDI and serves an old, vulnerable PCA 2011-signed boot manager via USB or PXE boot.
Direct Volume Access (T1006) - чтение содержимого расшифрованного тома
CVE-2025-48804 эксплуатирует первое и второе изменения. CWE-349 ... атакующий подаёт boot manager легитимный WIM-файл для прохождения проверки целостности, но присоединяет вредоносную нагрузку. Система верифицирует чистую часть - и слепо запускает код атакующего.
When the boot manager loads a legitimate WIM file referenced by an SDI for integrity verification, it simultaneously allows a second, attacker-controlled WIM to be appended to the SDI’s blob table. The boot manager verifies the first (legitimate) WIM but actually boots from the second, which contains a WinRE image modified to launch cmd.exe with the BitLocker volume already decrypted and mounted.
During the attack, the system verifies a legitimate WIM file, while the actual boot process is performed from a second attacker-modified WIM image.
The critical weakness enabling the BitUnlocker attack is not a missing patch it is an unrevoked signing certificate. Secure Boot validates a binary’s signing certificate, not its version number. The legacy Microsoft Windows PCA 2011 certificate... remains trusted... This means a pre-patch bootmgfw.efi, signed under PCA 2011, is still considered completely valid by Secure Boot despite being vulnerable.
the tool demonstrates a practical downgrade attack that allows attackers with physical access to gain access to encrypted disks on patched Windows 11 devices
Credential Access - извлечение SAM / SYSTEM для offline-атаки на хеши (T1003)
DPAPI master keys, сохранённых учётных данных, закрытых ключей (T1552.004)
Secure Boot до сих пор доверяет устаревшему сертификату Windows PCA 2011, и атакующий спокойно грузит уязвимую версию boot manager
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.