[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fElXKv3rtpDqxZwBdT23waixZYN60zIS60b2l_qgkPy0":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"d95f74d1-913a-4430-86ae-85fca6b6e864","🔒 Firmware persistence is real\n\nCampaigns like ArcaneDoor deploy bootkits that live below the OS...","firmware-persistence-is-real-campaigns-like-arcanedoor-deploy-bootkits-that-live-5d5878","🔒 Firmware persistence is real\n\nCampaigns like ArcaneDoor deploy bootkits that live below the OS.\n\nThey survive reboots.\nThey suppress logs.\nThey stay invisible.","The ArcaneDoor campaign leverages firmware-level bootkits to achieve persistence that survives reboots and evades detection by operating below the operating system. These bootkits suppress logging and maintain invisibility, making them difficult to detect and remove through conventional security measures. This represents a significant escalation in adversary sophistication and capability.","ArcaneDoor campaign deploys firmware bootkits for persistent below-OS access.","https:\u002F\u002Fx.com\u002FSentinelOne\u002Fstatus\u002F2042288867227914372",null,"2026-04-09T17:09:44+00:00","2026-04-09T18:00:13.818825+00:00",9,[17],{"name":18,"type":19},"ArcaneDoor","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":12,"name":22,"slug":23},"Malware","malware",[25,30,35],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":43,"vendors":123},[44,73,94],{"slug":45,"name":46,"problem":47,"products":48},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":74,"name":75,"problem":76,"products":77},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[78,86],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":135},"firmware-level-bootkits-achieve-unprecedented-persistence","Firmware-Level Bootkits Achieve Unprecedented Persistence","The ArcaneDoor campaign demonstrates how attackers are moving below the operating system level to establish persistence through firmware bootkits. These sophisticated threats survive system reboots and traditional security measures because they operate at the firmware level, suppressing logging and evading detection. This represents a critical escalation in attack complexity that requires fundamental changes to security monitoring and vulnerability management approaches. Organizations must recognize that conventional endpoint protection is insufficient against firmware-level threats.",[129,130,131,132,133,134],"CIS Control 3.5","CIS Control 8.1","NIST SP 800-147","NIST SP 800-155","NIST IR-4","ISO 27001 A.12.2",{}]