New UEFI bootkit BlackX bypasses Secure Boot on fully patched Windows
Researchers say BlackX infected fully updated Windows machines by reusing a 2022 boot-manager flaw Microsoft never fully closed.
What to know
- BlackX bypasses Secure Boot on Windows systems that had every relevant Microsoft patch installed, mirroring the 2023 BlackLotus bootkit.
- Both bootkits exploit 'Baton Drop' (CVE-2022-21894), a Windows boot-manager logic flaw patched in 2022 but not fully closed by certificate revocations until 2023-2024.
- The incident raises the question of whether Microsoft's unclear or incomplete implementation of Secure Boot protections, rather than a new exploit, let BlackX succeed.
Microsoft Windows and Secure Boot vendorBlackLotus Precedent UEFI bootkit (2023)BlackX Newly identified UEFI bootkit
How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts
-
2
Reader blames Microsoft's Secure Boot handling
A Mastodon reader responding to the Ars Technica report argued the recurring Secure Boot failures point squarely back to Microsoft.
“The answer to "is Microslop to blame?" is always, inevitably, yes...”
— kim_harding@mastodon.scot -
M
https:// arstechnica.com/security/2026/ 11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/ calls to mind something I wrote back in 2022: https:// mjg59.dreamwidth.org/60248.html . Systems are vulnerable to UEFI secure boot bypasses because Microsoft refuses to revoke their old bootloaders by default, because that would…
-
-
1
BlackX bootkit found infecting fully patched Windows systems
Ars Technica reports that organizations infected by a new bootkit tracked as BlackX had installed all of Microsoft's prior patches and certificate updates, yet BlackX still bypassed Secure Boot via the same Baton Drop flaw, reopening the question of whether Microsoft's unclear implementation is to blame.
“UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.”
— Ars Technica -
first by Mastodon, 5d ago · also Ars Technica
-
first by UA.NEWS, 5d ago
-
-
background
Microsoft enables revocation of the old boot-manager certificate — A further Microsoft update provided the means to revoke trust in the digital certificate used to sign older, vulnerable Windows boot managers, intended to finally close the BlackLotus vector.
-
background
Microsoft starts closing the certificate gap — Two months after BlackLotus surfaced, Microsoft began a multi-year remediation, issuing an update that added a new certificate no longer trusting the vulnerable boot managers.
-
background
BlackLotus emerges as first in-the-wild Secure Boot bypass — BlackLotus became the first publicly documented UEFI bootkit able to bypass Secure Boot on fully updated Windows 11 systems, exploiting the unrevoked certificate gap left after the 2022 patch.
-
background
Microsoft patches the Baton Drop boot-manager flaw — Microsoft fixed CVE-2022-21894, a logic flaw in the Windows boot manager dubbed 'Baton Drop' that allows Secure Boot bypass and, in some cases, BitLocker key extraction, but did not revoke trust in the certificate used to sign older vulnerable boot managers.