A UEFI bootkit dubbed BlackX has infected organizations running fully patched Windows systems, raising questions about whether Microsoft's remediation went far enough.

BlackLotus, documented in 2023, was the first publicly known in-the-wild UEFI bootkit able to bypass Secure Boot on fully updated Windows 11 machines, running malicious code before Windows loaded and most defenses were active.

Microsoft patched the exploited flaw in 2022, then issued further updates in 2023 and 2024-one adding a certificate that no longer trusted vulnerable boot managers, another enabling revocation of trust in the certificate signing older vulnerable boot managers. The BlackX victims had installed all of these patches.

Both bootkits exploit "Baton Drop," a logic flaw in the Windows boot manager tracked as CVE-2022-21894 that allows Secure Boot bypass and, under certain conditions, extraction of BitLocker keys. Microsoft fixed the flaw in 2022 but did not revoke trust in the certificate used to sign older vulnerable boot managers-a gap BlackLotus exploited to load a malicious kernel-mode driver.

Source: Ars Technica