Microsoft gives tips on spotting this undetectable malware

It’s detectable alright, if you know what to look for

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

Microsoftshows there are ways IT teams can detect an “invisible” and stubbornly persistent piece ofmalwarecalled BlackLotus, as the Redmond giant publishes detailed guidance on defending against the UEFI bootkit.

BlackLotus is a sophisticated malware variant that targets the Unified Extensible Firmware Interface, or UEFI, that boots up pretty much every component of today’s computers.

As it runs before the computer’soperating system, placing the malware here means it can disableantivirusprotections or even remain operational while security solutions are up and running. It also means that the malware will remain on the device even after the operating system is reinstalled - and even if the victim replaces the hard drive.

Spotting the malware

Threat actors usually look to deploy BlackLotus by leveraging a vulnerability tracked as CVE-2022-21894. The malware is on sale on the dark forums, going for roughly $5,000, BleepingComputer reports. Rebuilds are available for roughly $200.

All of this makes it very hard to detect and remove. However, with Microsoft’s guidance, it should be somewhat easier. As per the report, analyzing these artifacts can help determine if your system has been infected with the BlackLotus UEFI bootkit:

‘Near-undetectable’ hacking tool up for sale on malware forum>A new dangerous malware is turning Windows and Linux devices into DDoS tools>Here’s our list of the best endpoint protection tools

To clean a device from a BlackLotus compromise, one must remove it from the network, and reinstall it with a clean operating system and EFI partition, the researchers instruct. Alternatively, they can restore it from a clean backup with an EFI partition.

It’s also worth mentioning that threat actors need to leverage a specific vulnerability - CVE-2022-21894 - to deploy BlackLotus. Having a patch installed which addresses this vulnerability can also help protect the device from future infections.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Finally, as the company says: “Avoid the use of domain-wide, admin-level service accounts. Restricting local administrative privileges can help limit installation of remote access trojans (RATs) and other unwanted applications”.

Via:BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

A new form of macOS malware is being used by devious North Korean hackers

Scammers are using fake copyright infringement claims to hack businesses

This super-cheap HP Victus 15 gaming laptop just dropped to its lowest price yet