Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually?
In other words, is it still enough to be careful with social engineering, or are we more screwed than that?
Right now, we don't know how it gets its way to the target.
But, we do know that it comes in the form of an installer, which then requires a system reboot to enable persistence, and then another reboot to do its actual job.
> In all subsequent boots, the self-signed UEFI bootkit is executed and deploys both its kernel driver and user-mode payload, the HTTP downloader. Together, these components are able to download and execute additional user-mode and driver components from the C&C server and protect the bootkit against removal
[0] https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bo...
This piece of malware is not related to distribution, and must be executed manually (or, more likely, executed by a different malware sample serving as a loader). So you can use it in a social engineering attack, deploy it org-wide after exploiting AD, install it using some kind of RCE, etc.
That's not very reassuring. Privilege escalation on Windows is a well studied subject:
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/mas...