A UEFI bootkit known as BlackX infected organizations running fully patched Windows systems, according to the recovered report. The incident raises questions about Microsoft’s handling of Secure Boot protections, since the affected organizations had installed the updates issued in 2022, 2023 and 2024.
BlackX follows BlackLotus, which in 2023 became the first publicly documented UEFI bootkit observed in the wild to bypass Secure Boot on fully updated Windows 11 systems. By compromising the chain of trust, such malware can run before Windows has fully loaded and before many of its security defenses are active.
The bootkits exploit a flaw in the Windows boot manager called “Baton Drop,” tracked as CVE-2022-21894. The vulnerability allows attackers to bypass Secure Boot and, in some circumstances, extract BitLocker encryption keys. Microsoft fixed the flaw in 2022, but the fix did not revoke trust in the certificate used to sign older, vulnerable boot managers.
Microsoft later issued two further updates. One introduced a certificate that no longer trusted the vulnerable boot managers; another provided a way to revoke trust in the digital certificate used to sign them. Yet organizations affected by BlackX had installed these updates, according to the report.
UEFI firmware runs when a computer starts, initializing hardware and preparing the system to load its operating system. Secure Boot is designed to verify the digital signatures of boot software, including the boot manager, before allowing it to run. The report says the gap between fixing the flaw and removing trust in older signed boot managers enabled BlackLotus to exploit the issue and load a malicious kernel-mode driver.
Sources: Ars Technica.