Ars Technica reports that a new UEFI bootkit named BlackX managed to infect fully updated Windows machines, raising questions about how malicious code bypassed defenses. Even though organizations had installed all available fixes, the malware still compromised systems that relied on industry-wide chain-of-trust protections.
Key takeaways
- A new UEFI bootkit called BlackX infected fully patched Windows systems.
- The malware exploits Baton Drop, a logic flaw tracked as CVE-2022-21894.
- BlackLotus previously demonstrated similar bypass techniques in 2023 on Windows 11.
- Microsoft released patches and certificates in 2022, 2023, and 2024 to address the underlying issues.
How did a UEFI bootkit infect fully patched machines?
Unified Extensible Firmware Interface firmware runs as soon as a computer starts, handling hardware initialization and loading the operating system. Secure Boot uses digital signatures to verify every piece of software before execution, preventing unauthorized boot code from running. Both BlackLotus and BlackX use Baton Drop, a logic flaw in the Windows boot manager.
Microsoft issued a fix for CVE-2022-21894 back in 2022. Later updates in 2023 and 2024 added a fresh certificate and provided ways to revoke trust in older digital certificates used by vulnerable boot managers. Despite applying these exact updates, victim organizations still fell prey to the new threat.
Understanding the role of BlackLotus
In 2023, malware known as BlackLotus gained attention as the first publicly documented in-the-wild UEFI bootkit able to bypass Secure Boot on fully updated Windows 11 devices. It executed malicious code before the operating system loaded and before defense mechanisms became operational.
Because Microsoft did not initially revoke trust in the older certificate used to sign vulnerable boot managers, BlackLotus exploited that gap to load a malicious kernel-mode driver. BlackX uses similar methods to target systems, proving that old gaps can remain dangerous even after companies ship fixes.
What it means for system security
Security teams and administrators now face tough questions regarding how attackers slip past defense layers when machines are completely up to date. Ars Technica highlights that despite multiple rounds of certificates and patches from Microsoft, sophisticated malware continues to find open doors in standard boot processes.
Frequently asked questions
BlackX is a new UEFI bootkit that infected fully patched Windows machines by exploiting older vulnerabilities related to the Windows boot manager.
Secure Boot is a security feature that verifies digital signatures of boot software before allowing it to run, establishing a chain of trust to block unauthorized code.
Baton Drop is a logic flaw in the Windows boot manager, tracked as CVE-2022-21894, which lets attackers bypass Secure Boot and extract BitLocker keys under specific conditions.
BlackLotus emerged in 2023 as the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems.
Microsoft fixed CVE-2022-21894 in 2022, and later issued updates in 2023 and 2024 that added a new certificate and provided means to revoke trust in older vulnerable boot managers.
Based on reporting by Ars Technica. Read the original article
