NSA's Guide to Blocking and Combating BlackLotus Malware Attacks

The NSA has released guidance on how to defend against BlackLotus UEFI bootkit malware attacks, which has been circulating on hacking forums since October 2022. The malware is capable of evading detection, withstanding removal efforts, and neutralizing multiple Windows security features. The NSA recommends applying the latest security updates, hardening defensive policies, and customizing UEFI Secure Boot to block older signed Windows boot loaders. The agency also advises system administrators to implement hardening actions on systems patched against this vulnerability and to use endpoint security products and firmware monitoring tools to monitor device integrity measurements and boot configuration.