Loading story…
Researchers reported that BlackLotus is the first known in-the-wild UEFI bootkit able to bypass UEFI Secure Boot on fully updated Windows 11 and other UEFI systems. The malware abuses weaknesses tied to CVE-2022-21894 and later CVE-2023-24932, allowing it to execute in the earliest software stage of boot, establish persistence across restarts, and evade normal remediation. ESET said BlackLotus had been advertised on underground forums since at least October 2022 and documented real-world samples that install a kernel driver and a user-mode payload, with follow-on capability for HTTP-based command-and-control and additional payload delivery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft published support guidance for managing Windows Boot Manager revocations tied to Secure Boot changes associated with CVE-2023-24932, documenting how administrators should handle the mitigation.
On 2026-05-20, LOLDrivers published an entry for blacklotus_driver.sys with sample hashes, service creation details, and detection resources for the malicious driver component associated with BlackLotus.
On 2023-06-22, the U.S. NSA released guidance on defending against BlackLotus, warning that patching alone may not fully mitigate the threat and recommending additional Secure Boot and endpoint hardening steps.
The bootkit was described as having circulated since October 2022 and was identified by ESET as a real threat seen in the wild, not just an advertised product.
On 2023-03-06, Ars Technica reported on stealthy UEFI malware bypassing Secure Boot through a Windows flaw, amplifying public awareness of the BlackLotus threat.
On 2023-03-01, ESET published research analyzing BlackLotus and said it was the first known in-the-wild UEFI bootkit able to bypass UEFI Secure Boot on fully patched systems by abusing CVE-2022-21894.
ESET reported that the BlackLotus UEFI bootkit had been advertised on underground forums for $5,000 since at least early October 2022, indicating the malware was available to buyers before public technical analysis appeared.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
loldrivers.io
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourcebleepingcomputer.com
Open sourcearstechnica.com
Open sourcecsoonline.com
Open sourceeset.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**BlackLotus** was identified as the first publicly known UEFI bootkit seen in the wild that can bypass **UEFI Secure Boot** on fully patched Windows 11 systems by exploiting `CVE-2022-21894` and abusing legitimate Microsoft-signed boot binaries that were not added to the UEFI revocation database (`dbx`). ESET reported that the malware disables protections including **HVCI** and **BitLocker**, installs components to the EFI System Partition, enrolls an attacker-controlled Machine Owner Key, and persists through the boot process before loading a malicious kernel driver and an HTTP downloader into `winlogon.exe`. The malware also protects its files from removal and supports command-and-control tasking for payload delivery, updates, and uninstall. Microsoft said devices that have not yet received the **Secure Boot 2023 certificates** will continue to boot and receive normal updates while the certificates are rolled out over the coming months. The certificate transition is required because older **2011 Secure Boot certificates**, including the **Microsoft Corporation KEK CA 2011**, have expired, and the newer certificates are needed to keep delivering `dbx` revocation updates that block vulnerable bootloaders and bootkits such as BlackLotus. Microsoft said some systems remain delayed because of firmware incompatibilities, OEM support limits, disabled Secure Boot, Legacy BIOS mode, or unsupported Windows 11 installs, but most users do not need urgent action unless Windows reports a firmware-related Secure Boot warning.
Aug 14, 2026
ESET disclosed that **11 outdated Microsoft-signed Linux `shim` bootloaders** could be abused to bypass **UEFI Secure Boot** on systems that trust the **Microsoft Corporation UEFI CA 2011** certificate. The issue affects UEFI-based machines regardless of installed operating system because an attacker can introduce an old but still-trusted signed binary even if the device never originally shipped with it. Researchers said the vulnerable shims can trust insecure second-stage loaders such as **GRUB 2**, lack later protections including **MOK denylist enforcement** and **SBAT** support, and could let an attacker with administrative access or boot-process control run arbitrary code during early boot and install persistent UEFI bootkits such as **BlackLotus**, **Bootkitty**, or **HybridPetya**.
Aug 11, 2026
Researchers previously disclosed **LogoFAIL**, a broad set of UEFI image-parsing flaws that can let attackers execute code during the DXE boot phase by abusing OEM logo customization paths. The vulnerabilities affect parsers for formats including BMP, GIF, PNG, JPEG, PCX, and TGA, and can be triggered from attacker-controlled sources such as the EFI System Partition, firmware update volumes, or NVRAM. Binarly reported 29 root causes, including 15 likely exploitable issues, and demonstrated arbitrary code execution on a Lenovo ThinkCentre M70s Gen 2 via an AMI PNG parser flaw. The weaknesses can bypass protections such as **Secure Boot**, Intel Boot Guard, AMD hardware-validated boot, and ARM TrustZone-based verification, with impact spanning firmware from major BIOS and device vendors. Subsequent reporting said the **BootKitty** malware family exploited LogoFAIL to infect **Linux** systems, marking a notable evolution from a theoretical firmware weakness into active bootkit tradecraft. Coverage described the attack path as exceptionally difficult to detect or remove because it operates in UEFI before the operating system loads, allowing persistence below traditional endpoint defenses. The case also undercut assumptions that Linux systems are insulated from modern UEFI bootkits, showing that firmware-level compromise can survive OS reinstallations and evade both software- and hardware-based security controls.
Jun 29, 2026