Security researchers have identified a new UEFI bootkit tracked as BlackX that successfully compromised fully updated Windows systems, despite Microsoft releasing multiple security patches aimed at closing the vulnerability. The malware exploits a logic flaw known as “Baton Drop” in the Windows boot manager that allows attackers to bypass Secure Boot, a critical security feature designed to prevent unauthorized code from running during system startup.
The vulnerability was originally discovered in 2022 and tracked as CVE-2022-21894. Microsoft patched the underlying flaw that year, but did not revoke trust in the digital certificate used to sign older vulnerable boot managers. A predecessor bootkit called BlackLotus emerged in 2023 and demonstrated that this gap allowed attackers to load malicious kernel-mode drivers before Windows security defenses became operational. BlackX achieves the same objective years later, indicating the vulnerability window remains open.
Microsoft subsequently issued additional patches in 2023 and 2024. The first introduced a new certificate to the Secure Boot trusted database, while the second provided a mechanism to revoke trust in the older certificate associated with vulnerable boot managers. However, organizations infected by BlackX had installed all available patches, yet still fell victim to compromise. Security researchers from Kaspersky, who discovered the BlackX infections, attribute this gap to Microsoft’s unusual patch deployment approach that requires system administrators to take manual additional steps after installation to fully activate protections.
Microsoft has stated it is directing customers to follow guidance in a recently published Knowledge Base article. However, security researchers note that this guidance does not adequately warn of the risks posed by Baton Drop attacks or clearly communicate that manual activation steps are necessary. The researcher from Kaspersky indicated that administrators typically expect patches to provide complete protection upon installation and may not discover buried instructions for additional manual actions, particularly in enterprise environments managing numerous systems.
The incident highlights a significant challenge in Microsoft’s security posture: the company has delayed full enforcement of certificate revocations due to concerns about rendering potentially millions of unpatched devices unbootable. This extended window of vulnerability has persisted for several years, creating an opportunity that threat actors have evidently exploited. Security experts suggest that more explicit communication from Microsoft about the risks and required manual activation steps could have mitigated the threat.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI