BlackLotusMalware
Last reported yesterday, by The Hacker News5 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1542.003Bootkit
“BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations”
- T1053.005Scheduled Task
“A scheduled task named Secure-Boot-Update is created.”
- T1195Supply Chain Compromise
“Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.”
- T1552.004Private Keys
“Browser makers untrusted its root after it used weak private keys to generate eight intermediary certificates.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations“Notably, BlackX is assessed to be an updated version of BlackLotus, a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“APT41 revives BlackLotus bootkit: Chinese cyber espionage group APT42 has been using new versions of the BlackLotus bootkit , named BlackX, which they have used to target entities all over Central Asia.”
-
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia“How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia”
-
Los UEFI shims olvidados socavan Secure Boot“…able durante el arranque del sistema, lo que permite a los atacantes desplegar bootkits UEFI maliciosos (como Bootkitty, HybridPetya o BlackLotus) incluso en sistemas con UEFI Secure Boot habilitado.”
-
Forgotten UEFI shims undermining Secure Boot“…to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits (such as Bootkitty, HybridPetya, or BlackLotus) even on systems with UEFI Secure Boot enabled.”
Indicators in its reports
named in the reports above- ae75f0d82ba3df82…8bfd83a6b961in 2 reports
- 7b2a3f5c96f95bd8…215c8de9eb10in 2 reports
- eb86fa1386fe6e45…34a161018a0ain 2 reports
- fd23d6e57de6f4e1…3447268d50c5in 2 reports
- a0de9333442c1bf9…21bf6c1ae3e4in 2 reports
- 95b6d71fc0c0f8c5…a6759ce5fc06in 2 reports
- 236a9cb0d71951c3…5d9de549e19bin 2 reports
- 5e594c448760a313…a77f284fa63bin 2 reports
- 8a964d5f8373948d…b53d98ae8963in 2 reports
- 410260b1b6f5af5f…437f312db373in 2 reports
- 96275dfd6282a522…f92869028629in 2 reports
- 2e434a724b4759c9…3d635096dd2fin 2 reports
- railway[.]comin 1 report
- ocasionalmente[.]siin 1 report
- hxxps://github[.]com/rhboot/shim-reviewin 1 report
- pylos[.]coin 1 report
- infosec[.]exchangein 1 report
- 0bcdf5e0da32d68900b8b7638459d072in 1 report
- af8a983b9ada07eae1259bf2953abd40in 1 report
- www.archivetj[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.