Malware source code investigation: BlackLotus - part 1

BlackLotus is a UEFI bootkit that targets Windows and is capable of evading security software, persisting once it has infected a system, bypassing Secure Boot on fully patched installations of Windows 11, and executing payloads with the highest level of privileges available in the operating system.

The source code for the BlackLotus UEFI bootkit has been published on GitHub on July, 12, 2023.

Since at least October 2022, BlackLotus is a UEFI bootkit that has been for sale on hacking …

blacklotus boot bootkit bypassing code investigation malware malware analysis operating system privileges secure boot security security software software source code system uefi uefi bootkit windows windows 11