Researchers on Wednesday announced a major #cybersecurity find—the world’s first-known instance of real-world #malware that can hijack a computer’s boot process even when #Secure #Boot and other advanced protections are enabled and running on fully updated versions of #Windows.
Dubbed #BlackLotus, the malware is what’s known as a UEFI bootkit. These sophisticated pieces of malware target the #UEFI—short for Unified Extensible Firmware Interface—the low-level and complex chain of firmware responsible for booting up virtually every modern computer.
As the mechanism that bridges a PC’s device firmware with its operating system, the UEFI is an OS in its own right.
It’s located in an SPI-connected #flash storage chip soldered onto the computer motherboard, making it difficult to inspect or patch.
Previously discovered bootkits such as #CosmicStrand, #MosaicRegressor, and #MoonBounce work by targeting the UEFI firmware stored in the flash storage chip. Others, including BlackLotus, target the software stored in the EFI system partition.
While researchers have found Secure Boot vulnerabilities in the past, there has been no indication that threat actors have ever been able to bypass the protection in the 12 years it has been in existence.
Until now.
#mosaicregressor
APT Groups Finding Success with Mix of Old and New Tools - The APT threat landscape is a mixed bag of tried-and-true tactics and cutting-edge techniques, lar... https://threatpost.com/apt-groups-success-mix-tools/160927/ #advancedpersistentthreats #mostrecentthreatlists #vulnerabilities #mosaicregressor #deathstalker #uefifirmware #websecurity #aptgroups #aptreport #kaspersky #newtools #malware #q32020 #ttps #apt
"Wer aber hochsensible Informationen auf einem #Notebook schützen muss, sollte zuerst über eine Alternative zu #Windows als Betriebssystem nachdenken – denn auch #MosaicRegressor ist auf Windows angewiesen."
ЛК обнаружила целевую кампанию кибершпионажа с использованием UEFI буткита #UEFI, #MosaicRegressor, #буткит https://www.securitylab.ru/news/512755.php https://twitter.com/SecurityLabnews/status/1313180915900841984/photo/1