- Published
- Source
- Securelist (Kaspersky)
- Filed under
- Nation-state, Attacks, Malware & exploits
- Vulnerabilities
- 1 CVE
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
Defending against state-backed attackers
- Patch internet-facing devices first – VPNs, firewalls and email gateways are their usual way in.
- Hunt for the published indicators and techniques in your own logs, not just in your antivirus.
- Read the joint advisories: they name the products, the techniques and the signs to look for.
The vulnerabilities in this story
CVE-2022-21894 in the NVD (opens in a new tab)
- CVSS4.4Medium
- CISA KEVNot listedno confirmed exploitation on CISA’s list (yet)
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
MyCyberWay training
Blue Team Specialist
Breaches like this get investigated, not just reported.
Blue Team Specialist takes the Analyst curriculum and adds the investigator's work: one incident owned end to end, hypothesis-led threat hunting with MITRE ATT&CK and KQL, breach analysis, and a root cause report people can act on.
- Scope, attacker path and dwell time
- Threat hunting with ATT&CK and KQL
- Root cause analysis and reporting
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
