How to check Black lotus bootloader is infected in ESP partition files and other files in Windows partition.

[RAJU.MSC.MATHEMATICS]

Technical type: Intermediate Summary:BlackLotus writes malicious bootloader files to the EFI system partition (ESP) and subsequently locks them to protect them from deletion or tampering.If recently modified and locked files are identified in the ESP on a device, especially those matching known BlackLotus bootloader filenames, these should be considered highly suspect and the devices should be removed from the network to be examined for further evidence of BlackLotus or follow-on activityIn this article, I will explain how to check whether the files are infected or not 1. Open the Command Prom

Continue reading...