How To Hunt For UEFI Malware Using Velociraptor

UEFI threats have historically been limited in number and mostly implemented by nation state actors as stealthy persistence. However, the recent proliferation of Black Lotus on the dark web, Trickbot enumeration module (late 2022), and Glupteba (November 2023) indicates that this historical trend may be changing.

With this context, it

black lotus changing context dark dark web enumeration glupteba hunt malware may nation nation state november november 2023 persistence proliferation state threats trend trickbot uefi velociraptor web