InfoSecBulletin Cybersecurity for mankind
MSI attackers leaked the company’s firmware image signing keys, a crucial component for differentiating between legitimate and malicious updates. Over 200 MSI products are believed to be exposed.
Researchers have identified leaked firmware image signing keys and Intel’s BootGuard for MSI products. According to Alex Matrosov, CEO of firmware supply chain security platform Binarly, leaked firmware keys affect 57 MSI products, while leaked BootGuard keys affect 166 of the company’s products.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Firmware image signing keys are an essential part of the security infrastructure for hardware. The keys provide trust that the firmware is authentic and hasn’t been tampered with by anyone except the software developer or the device manufacturer.
Similarly, Intel Boot Guard is a processor safeguard that prevents the computer from running firmware images not published by the system manufacturer.
Exposing the keys poses significant risks to users as attackers with access to leaked keys can push malware-infected firmware images or firmware updates as legitimate.
Since firmware is often launched before the operating system starts, malicious code could fly under the radar of antivirus or other security measures. Attackers could also use the keys to modify the firmware, severely impacting the reliability of the device.
According to Binarly, the exposed devices include numerous models of MSI’s Stealth, Creator, Crosshair, Prestige, Pulse, Modern, Raider, Sword, Summit, Vector, and Katana series laptops. The complete list with specific models can be found here.
Earlier this year, the Money Message ransomware cartel published nearly 528 GB of data supposedly taken from the Taiwanese computer manufacturer Micro-Star International (MSI).
MSI confirmed that the company had suffered a cyberattack, with attackers supposedly demanding several million dollars in ransom for the stolen MSI source code. The company refused to pay the ransom.
MSI is a major information technologies player in the global market, with a presence in over 100 countries and a yearly revenue hovering close to $6 billion (TWD 180 billion).
