BlackLotus
Malware⚠️ Overview
BlackLotus is a sophisticated UEFI bootkit first publicly documented in March 2023 by security researchers at ESET, operating as a commercial malware-as-a-service (MaaS) offering on underground forums since at least early 2022. It belongs to the category of UEFI bootkits and rootkits designed to achieve low-level system persistence, evade endpoint detection, and maintain stealthy control over compromised Windows systems.
🔧 Technical Capabilities
BlackLotus exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot using a self-signed Microsoft Hardware Publisher certificate, allowing it to load a malicious bootloader before the operating system kernel. Its core functionality includes deploying a ring-0 kernel driver that hooks and modifies system calls such as NtCreateFile, NtReadFile, and NtOpenProcess to conceal its files, processes, and registry keys from security software. Persistence is achieved via a UEFI boot partition entry and the modification of EFI partitions, while C2 communication uses HTTPS over ports 443/8443 with a hardcoded command-and-control server IP and a custom encryption scheme involving AES and XOR. Evasion techniques include disabling Windows Defender via WMI and registry manipulation, as well as injecting malicious code into legitimate system processes like svchost.exe.
📜 History & Notable Incidents
First observed in the wild in November 2022, BlackLotus gained public attention when ESET published a detailed analysis (WeLiveSecurity, March 1, 2023) revealing its use of expired Microsoft certificate chains. ESET reported that the bootkit was sold on Russian-language dark web forums for approximately $5,000 per license and targeted high-value victims in government, finance, and energy sectors across Europe and North America. No official law enforcement actions have been publicly documented as of early 2025, but Microsoft issued an emergency out-of-band patch (KB5025885) in May 2023 to address the Secure Boot bypass vector.
🔍 Detection Indicators
Known file hashes include SHA-256: 9c7e8f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9 (sample bootloader) and SHA-1: e3d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2 (kernel driver). Behavioral indicators include an unregistered EFI partition named "EFIMicrosoftBootootmgfw.efi" with non-standard file sizes, suspicious registry keys under HKLMSYSTEMCurrentControlSetServices
☠️ Risk & Impact
The bootkit enables full remote control of compromised systems, allowing attackers to deploy additional payloads such as ransomware, keyloggers, or credential stealers, leading to data exfiltration and potential financial losses. Sectors most affected include government, defense, financial services, and critical infrastructure, where persistent UEFI-level access poses a severe risk of long-term espionage and system compromise that survives OS reinstallation.
🛡️ Mitigation
Defensive measures include applying Microsoft's KB5025885 and subsequent Secure Boot firmware updates, enabling Trusted Platform Module (TPM) 2.0 and Secure Boot with latest certificate revocation lists, and deploying EDR solutions like ESET's detection rules (Win64/BlackLotus.A trojan) or SentinelOne's UEFI scanning modules that monitor for anomalous bootloader modifications.
Similar Threats
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
