# MA-922.042023: MyCERT Advisory - Microsoft Releases Guidance for the BlackLotus Campaign

**Date:** 14 Apr 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-922.042023  
**Advisory ID:** MA-922.042023

---

**1.0 Introduction**
Recently, Microsoft has released [Guidance for investigating attacks using CVE-2022-21894: The BlackLotus Campaign](https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/). According to Microsoft, “[t]his guide provides steps that organizations can take to assess whether users have been targeted or compromised by threat actors exploiting [CVE-2022-21894](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21894) via a Unified Extensible Firmware Interface (UEFI) bootkit called BlackLotus.”
**2.0 Impact**
An attacker could exploit this vulnerability to take control of an affected system.
**3.0 Affected Products**
PCs with Microsoft Windows OS installed
**4.0 Recommendations**
MyCERT urges users and organizations to review the [Microsoft Blog Post](https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/) for more information, and apply necessary detection, recovery, and prevention strategies.
Kindly refer to : <https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/news-events/alerts/2023/04/11/microsoft-releases-guidance-for-the-blacklotus-campaign>
- <https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/>