NSA: BlackLotus BootKit Patching Wont Prevent Compromise

Its unclear why the NSA issued in-depth mitigation guidance for the software boot threat now, but orgs should take steps to harden their environments.

The US National Security Agency (NSA) is urging systems administrators to go beyond patching in order to protect Windows 10 and 11 machines from the BlackLotus bootkit malware.
BlackLotus burst on the scene last fall
when it was spotted for sale on the Dark Web for $5,000. It has the dubious distinction of being the first in-the-wild malware to successfully bypass to Microsofts Unified Extensible Firmware Interface (UEFI) Secure Boot protections.
UEFI is the firmware thats responsible for the booting-up routine, so it loads before the operating system kernel and any other software. BlackLotus — a software, not
a firmware threat
, it should be noted — takes advantage of two vulnerabilities in the UEFI Secure Boot function to insert itself into the earliest phase of the software boot process initiated by UEFI:
CVE-2022-21894
, aka Baton Drop, CVSS score 4.4; and
CVE-2023-24932
, CVSS score 6.7. These were patched by Microsoft in January 2022 and May 2023 respectively.
But the countrys top technology intelligence division warned that applying the available Windows 10 and Windows 11 patches is only a a good first step.
Patches were not issued to revoke trust in unpatched boot loaders via the Secure Boot Deny List Database (DBX), according to a
BlackLotus mitigation guide (PDF)
released by the NSA this week. Administrators should not consider the threat fully remediated as boot loaders vulnerable to Baton Drop are still trusted by Secure Boot.
That means that bad actors can simply replace fully patched boot loaders with legitimate but vulnerable versions in order to execute BlackLotus on compromised endpoints. Its an issue that Microsoft is addressing with a more comprehensive fix planned for release in early 2024, but until then, the NSA recommends that infrastructure owners take additional steps to harden their systems, such as tightening up user executable policies, and monitoring the integrity of the boot partition. An optional advanced mitigation is to customize the Secure Boot policy by adding DBX records to all Windows endpoints.
Protecting systems against BlackLotus is not a simple fix, said NSA platform security analyst Zachary Blum, in the advisory.
And indeed, the advisory offers extensive hardening advice, but fully implementing the NSAs guidance is a process unto itself, notes John Gallagher, vice president of Viakoo Labs.
Given the manual nature of NSAs guidance, many organizations will find that they dont have the resources needed to fully remediate this vulnerability. Additional measures like use of network access control and traffic analysis should also be used until Microsoft can provide a more complete fix, he says.
Executing malware like BlackLotus does offer cyberattackers several significant advantages, including ensuring persistence even after OS reinstalls and hard drive replacements. And, because the bad code executes in kernel mode ahead of security software, its undetectable by standard defenses like BitLocker and Windows Defender (and can indeed turn them off entirely). It also can control and subvert every other program on the machine and can load additional stealthy malware that will execute with root privileges.
UEFI vulnerabilities, as the guidance from NSA shows, are particularly difficult to mitigate and remediate because they are in the earliest stage of software and hardware interactions, says Gallagher. The guidance NSA is providing is critically important as a reminder to pay attention to boot-level vulnerabilities and have a method to address them.
It all sounds pretty dire — an assessment of which many systems administrators agree. But as the NSA noted, most security teams are confused about how to combat the danger that the bootkit poses.
Some organizations use terms like unstoppable, unkillable, and unpatchable to describe the threat, according to the NSA guidance. Other organizations believe there is no threat, due to patches that Microsoft released in January 2022 and early 2023 for supported versions of Windows. The risk exists somewhere between both extremes.
The NSA didnt provide an explanation for why its issuing the guidance now — i.e., it didnt issue information about recent mass exploitation efforts or in-the-wild incidents. But John Bambenek, principal threat hunter at Netenrich, notes that the NSA piping up at all should indicate that BlackLotus is a threat that requires attention.
Whenever the NSA releases a tool or guidance, the most important information is what they arent saying, he says. They took the time and effort to develop this tool, declassify it, and release it. They will never say why, but the reason was worth a significant diversion from how they usually operate by saying nothing.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
NSA: BlackLotus BootKit Patching Wont Prevent Compromise