A newly identified UEFI bootkit, referred to as BlackX, has successfully compromised fully updated Windows 11 machines, according to a report by Ars Technica. This development highlights a persistent security challenge, as the malware manages to execute malicious code before the operating system and its primary security defenses are fully initialized.
The Mechanics of the Attack
The BlackX bootkit functions similarly to BlackLotus, the first publicly documented UEFI bootkit capable of bypassing Secure Boot on modern Windows systems. Both threats exploit a logic flaw known as “Baton Drop,” tracked as CVE-2022-21894. This vulnerability allows attackers to circumvent the Secure Boot chain of trust, which is designed to verify the digital signatures of boot software before execution.
By subverting this process, the malware can load unauthorized boot code, potentially allowing it to extract BitLocker encryption keys or install malicious kernel-mode drivers. Because UEFI firmware runs immediately upon power-up to initialize hardware and prepare the operating system, an infection at this level grants the attacker significant control over the device before standard security measures can intervene.
Limitations of Microsoft’s Patching
Microsoft addressed the underlying CVE-2022-21894 vulnerability in 2022. Following the emergence of BlackLotus, the company released further updates in 2023 and 2024. These measures included introducing a new certificate that excluded vulnerable boot managers and providing mechanisms to revoke trust in the digital certificates used to sign older, susceptible versions of the Windows boot manager.
Despite these efforts, organizations that had applied all available security updates remained vulnerable to BlackX. The persistence of this threat suggests that while Microsoft has taken steps to mitigate the “Baton Drop” flaw, the revocation of trust for older, vulnerable boot managers has not been sufficient to prevent sophisticated attackers from exploiting the gap. The ability of BlackX to infect systems that are ostensibly fully patched underscores the complexity of maintaining a secure boot environment against firmware-level threats.
