BlackX UEFI bootkit installer and renamed jcef_helper payload execution

Ankit Mehta@Secvyn

•updated 2 days ago•2•0•2

Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.