New UEFI Bootkit BlackX Infects Fully Patched Windows Systems
A sophisticated new UEFI bootkit called BlackX has managed to infect fully updated Windows machines, exploiting a complex gap in Microsoft's security mitigation and patch deployment practices.
Radwan AbdulhadiEditor and technology writer
The Rise of BlackX on Fully Patched Systems
In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational, as detailed in reports regarding the discovery of BlackLotus.
Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. Subsequent updates issued by Microsoft added a new certificate and provided means to revoke trust in older digital certificates. However, organizations infected by the new bootkit, tracked as BlackX, had installed all of these required patches, raising urgent questions about how they fell victim.
Understanding UEFI and Secure Boot Mechanics
Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its operating system. Detailed technical specifications can be found via the Unified Extensible Firmware Interface documentation.
Another important function is Secure Boot, a security feature that establishes a chain of trust by verifying digital signatures of boot software before execution. For deeper guidance, security professionals often consult the official Secure Boot specification documents.
The 'Baton Drop' Exploit and the Vulnerability Gap
Both BlackLotus and BlackX exploit 'Baton Drop,' a logic flaw in the Windows boot manager that allows attackers to bypass Secure Boot and extract BitLocker encryption keys under certain conditions. The vulnerability, tracked as CVE-2022-21894, came to light in 2022. Microsoft fixed the vulnerability that same year, but it did not initially revoke trust in the certificate used to sign older vulnerable boot managers.
What makes these bootkits so valuable to attackers is that they execute early in the boot process, allowing them to load malicious drivers into the Windows kernel before many operating system and security defenses are operational.
Mitigation Challenges and Manual Activation Hurdles
In May 2023, Microsoft began a yearslong process aimed at closing the vulnerability by releasing security updates to prevent attackers from loading older vulnerable boot managers. Additional details on these updates were reported at the time, highlighting Microsoft's strategy to introduce a new signing certificate while managing revocation risks.
However, fear of rendering potentially millions of unbootable devices prevented Microsoft from immediately enforcing the revocations by default. As researchers wrote recently regarding the UEFI bootkit BlackX, this practice creates an unusual burden for system administrators.
Administrative Oversight and Future Risks
Security analysts note that system administrators rarely take extra manual steps after installing standard updates unless installation fails. Instructions for fully activating the mitigation are often buried deep on documentation pages, such as this Knowledge Base post provided by Microsoft.
Furthermore, analysts point to previous documentation like the 2023 Knowledge Base guidelines, emphasizing that threat actors take advantage of the fact that few organizations realize the absolute necessity of manually activating these revocation steps.
Sources
- Ars TechnicaUEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
Continue chronologically
Related entity coverage
Related stories
BlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Boot
A new UEFI bootkit named BlackX has been deployed in an early 2026 espionage campaign, exploiting the Baton Drop flaw to bypass Windows Secure Boot.
Microsoft Steps Back From Copilot+ PC Branding
Microsoft and its hardware partners are quietly dropping the Copilot+ PC brand, omitting the AI marketing label from new Surface devices.
Microsoft Posts Strong Cloud Growth in Q1 2027
Microsoft reported Q1 2027 earnings with $92.3 billion in revenue and $33.6 billion in net income, driven by cloud growth and reporting changes.
Microsoft Offers Voluntary Exit Buyouts to 60,000 Employees
Microsoft is offering voluntary buyouts to approximately 60,000 employees across multiple countries in an effort to cut costs and rework its workforce.
