UEFI bootkits and BlackLotus

Try it out loud first. Then check yourself:

1. Bootkits run before the OS loader, so they can tamper with the kernel before EDR, HVCI or BitLocker protections start
2. BlackLotus (ESET, 2023) used CVE-2022-21894: old signed but vulnerable Windows boot managers that were not yet in DBX
3. It enrolled an attacker-owned MOK for persistence on the ESP and could disable HVCI, BitLocker and Defender
4. Patching the OS does not help while vulnerable signed binaries stay trusted; revocation needs DBX/SVN updates
5. DBX revocation can brick old boot media, so Microsoft (CVE-2023-24932, KB5025885) staged opt-in, manual mitigations

If the interviewer pushes back

• How would you detect a bootkit when you cannot trust anything the running OS tells you?
• Compare an ESP-resident bootkit with SPI flash implants like LoJax or MosaicRegressor for persistence and remediation.

Go deeper

• attack.mitre.org/techniques/T1542/003/