Microsoft has issued guidance for organizations and individuals to determine if their machines have been targeted or compromised by the BlackLotus UEFI bootkit. The bootkit exploits the CVE-2022-21894 vulnerability, a flaw in the Microsoft operating system.
UEFI malware is challenging to detect because it runs before the operating system, allowing it to deploy payloads early in the boot process and disable security mechanisms. To detect BlackLotus infection, Microsoft’s Incident Response team recommends looking for recently created and locked bootloader files, a staging directory used during BlackLotus installation in the EPS filesystem, registry key modification for the Hypervisor-protected Code Integrity, network logs, boot configuration logs, and boot partition artifacts.
BlackLotus has been available on hacking forums since last year, advertised as a piece of malware that evades antivirus detection, resists removal attempts, and can disable various security features.
Successful installation of BlackLotus results in deleting the files inside “ESP:/system32/,” but the directory remains. Microsoft recommends examining network logs for outbound connections from winlogon.exe on port 80, indicative of BlackLotus trying to communicate with its command and control server. Another tell of BlackLotus is the presence of the “/system32/” directory on the ESP, which is the storage location for the files required to install the UEFI malware.
The malware can disable the hypervisor-protected code integrity and Microsoft Defender Antivirus, leaving traces in the Windows Event Logs. MeasuredBoot logs can provide details about the Windows boot process, and analysts can compare logs for each reboot of the system to find components that have been added or removed from each machine boot.
To prevent threat actors using BlackLotus from achieving persistence and evading detection, Microsoft advises implementing security best practices, such as keeping software updated, applying security patches, using antivirus software and firewalls, and deploying intrusion detection systems. Microsoft also recommends performing regular system backups and maintaining an incident response plan.
BlackLotus costs $5,000 for a license, with rebuilds available for $200. ESET cybersecurity company confirmed the malware’s capabilities in early March, noting that the malware functioned exactly as advertised.
In the wake of such threats, Microsoft recently launched a tool called Microsoft Defender for Endpoint for IoT, which provides enhanced IoT security. The tool adds another layer of protection to IoT devices, improving threat detection and response capabilities for Microsoft Defender for Endpoint customers.
